securityaffairs.com 6/9/2026, 8:41:42 AM · external

CVE-2026-23111 flaw in Linux nf_tables lets local users gain root

CVE-2026-23111 flaw in Linux nf_tables lets local users gain root
CyberSIXT Evidence Panel
Primary Source blog.exodusintel.com
CVE Intel
CISA KEV Not in KEV
Patch Patch Available

THE article discusses CVE-2026-23111, a Linux kernel nf_tables bug that allows local users to gain root privileges via a use-after-free vulnerability. Discovered by researcher Oliver Sieber in 2025, the flaw originates from a logical error in the nf_tables package filtering framework. A simple patch was issued on February 5, 2026, which involved removing a single negation character from the source code.

This vulnerability can be exploited by unprivileged users in environments where user namespaces and nf_tables are enabled. Demonstrated on multiple Linux distributions (Debian, Ubuntu), the exploit showcased stable performance even under load. Various Linux distributions have released patches, emphasizing the importance for users to update their kernels and reboot.

View Primary Source Via securityaffairs.com

Article by CyberSIXT

Timeline Coverage

Swipe to explore timeline