PT-2026-7991 · Linux+3 · Linux Kernel+3
CVE-2026-23111
·
Published
2026-01-01
·
Updated
2026-07-18
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A use-after-free issue exists in the
nf tables component of the Linux kernel. The nft map catchall activate() function contains a logic bug where an inverted element activity check is performed during the abort path of a failed transaction. Specifically, the function incorrectly skips inactive elements and processes active ones, which is the opposite of the required behavior seen in nft mapelem activate().When a
DELSET operation is aborted, nft setelem data activate() is not called for the catchall element. For NFT GOTO verdict elements, this prevents nft data hold() from restoring the chain->use reference count. Repeated abort cycles permanently decrement chain->use until it reaches zero, allowing a DELCHAIN operation to free the chain while catchall verdict elements still reference it. A local low-privileged user can exploit this via user namespaces and nftables on distributions where CONFIG USER NS and CONFIG NF TABLES are enabled to achieve local privilege escalation to root and escape containers.Recommendations
Update the Linux kernel to the version containing the patch released on February 5, 2026.
As a temporary mitigation, restrict the ability of unprivileged users to create network namespaces by setting
kernel.unprivileged userns clone=0.Exploit
Fix
LPE
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Rocky Linux
Ubuntu