Linux kernel nf_tables use-after-free in nft_map_catchall_activate() (single-character genmask inversion) — local-root + container escape, working public exploit (Exodus Intelligence), patched upstream 2026-02-05, CVSS 7.8

cve · CVE-2026-23111

Coverage timeline

first 2026-06-09 → last 2026-06-14

Peak priority

high

1 high

Sources cited

3 hosts

Sections touched

research

Co-occurring entities

no co-occurrence

ATT&CK techniques

pinned v19.1 · see below

Hunting pivots

ATT&CK techniques

2 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-06-09/exodus-intelligence-publishes-working-exploit-for-a-one-char · ATT&CK page ↗

T1611Escape to Host×1

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-06-09/exodus-intelligence-publishes-working-exploit-for-a-one-char · ATT&CK page ↗

Story timeline

2026-06-09Exodus Intelligence publishes working exploit for a one-character Linux kernel nf_tables use-after-free (CVE-2026-23111)
research

Where this entity is cited

research1

Source distribution

blog.exodusintel.com1 (33%)
thehackernews.com1 (33%)
ubuntu.com1 (33%)

explore in graph

External references

NVD · cve.org · CISA KEV

All cited sources (3)

Entries about Linux kernel nf_tables use-after-free in nft_map_catchall_activate() (single-character genmask inversion) — local-root + container escape, working public exploit (Exodus Intelligence), patched upstream 2026-02-05, CVSS 7.8 (1)

2026-06-09 · view entry permalink →

HIGHCVE-2026-23111

Exodus Intelligence publishes working exploit for a one-character Linux kernel nf_tables use-after-free (CVE-2026-23111)

Exodus Intelligence released a full technical write-up and working exploit for CVE-2026-23111, a use-after-free in the Linux kernel nf_tables subsystem caused by a single misplaced ! operator in nft_map_catchall_activate() that inverts the genmask check and skips inactive catchall elements during the abort path (Exodus Intelligence, 2026-06-08). Exodus reports >99% reliability on idle Debian Bookworm/Trixie and Ubuntu 22.04/24.04 LTS, yielding unprivileged-local-user to root escalation and container escape (T1068, T1611) (The Hacker News, 2026-06-08). The flaw was patched upstream on 5 February 2026; distro packages are shipping the fix (Ubuntu Security, rated 7.8). No network-reachable path exists — exploitation requires local access or code execution inside a container, making this high-value post-exploitation tooling for shared compute (Kubernetes nodes, CI/CD runners, multi-tenant VMs).

Why it matters to us: With a reliable public exploit now available, the patch gap is the exposure. Apply vendor kernel updates containing the 5 February upstream fix; in container environments enforce seccomp and AppArmor/SELinux profiles that restrict nf_tables syscalls for untrusted workloads. Detection concepts: anomalous UID transitions to 0 from non-root parents (Linux audit execve/setuid records); unexpected privileged process spawns inside containers.

research09 Jun 05:00Zmulti-sourceOpen finding ↗

Sources: Exodus Intelligence write-up · Ubuntu Security tracker · The Hacker News