CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Linux kernel nf_tables use-after-free in nft_map_catchall_activate() (single-character genmask inversion), local-root + container escape, working public exploit (Exodus Intelligence), patched upstream 2026-02-05, CVSS 7.8

cve · CVE-2026-23111

Coverage
1
first 2026-06-09 → last 2026-06-14
Latest activity
2026-06-09
Exodus Intelligence publishes working exploit for a one-character Linux kernel nf_tables use-after-free…
Peak priority
high
1 high
Targets
technology
sectors: technology
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-23111, newest first. Check the date before acting on an older one.

  • Apply kernel updates for CVE-2026-23111 and harden container syscall policy; a >99%-reliable public LPE/container-escape exploit is now available; ship the 5 February upstream fix and enforce seccomp/AppArmor restrictions on nf_tables for untrusted workloads.
    2026-06-09CVE-2026-23111

Story timeline

  1. 2026-06-09Exodus Intelligence publishes working exploit for a one-character Linux kernel nf_tables use-after-free (CVE-2026-23111)
    research

Hunting pivots

Tags
lpepoc-publicpriv-escvulnerabilities
ATT&CK techniques (2 across 1 tactic)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation · Escape to Host

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-06-09/exodus-intelligence-publishes-working-exploit-for-a-one-char · ATT&CK page ↗

T1611Escape to Host×1

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-06-09/exodus-intelligence-publishes-working-exploit-for-a-one-char · ATT&CK page ↗

Entries about Linux kernel nf_tables use-after-free in nft_map_catchall_activate() (single-character genmask inversion), local-root + container escape, working public exploit (Exodus Intelligence), patched upstream 2026-02-05, CVSS 7.8 (1)

2026-06-09 · view entry permalink →

HIGHCVE-2026-23111

Exodus Intelligence publishes working exploit for a one-character Linux kernel nf_tables use-after-free (CVE-2026-23111)

Exodus Intelligence released a full technical write-up and working exploit for CVE-2026-23111, a use-after-free in the Linux kernel nf_tables subsystem caused by a single misplaced ! operator in nft_map_catchall_activate() that inverts the genmask check and skips inactive catchall elements during the abort path (Exodus Intelligence, 2026-06-08). Exodus reports >99% reliability on idle Debian Bookworm/Trixie and Ubuntu 22.04/24.04 LTS, yielding unprivileged-local-user to root escalation and container escape (T1068, T1611) (The Hacker News, 2026-06-08). The flaw was patched upstream on 5 February 2026; distro packages are shipping the fix (Ubuntu Security, rated 7.8). No network-reachable path exists; exploitation requires local access or code execution inside a container, making this high-value post-exploitation tooling for shared compute (Kubernetes nodes, CI/CD runners, multi-tenant VMs).

Why it matters to us: With a reliable public exploit now available, the patch gap is the exposure. Apply vendor kernel updates containing the 5 February upstream fix; in container environments enforce seccomp and AppArmor/SELinux profiles that restrict nf_tables syscalls for untrusted workloads. Detection concepts: anomalous UID transitions to 0 from non-root parents (Linux audit execve/setuid records); unexpected privileged process spawns inside containers.

research09 Jun 05:00Zmulti-sourceOpen finding →
Sources: Exodus Intelligence write-up · Ubuntu Security tracker · The Hacker News

explore in graph

Where this entity is cited

  • Research1

Source distribution

  • blog.exodusintel.com1 (33%)
  • thehackernews.com1 (33%)
  • ubuntu.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)