Linux, Too Many Exclamation Points to Unlock Root Permissions
An extra exclamation point in the Linux kernel code was enough to turn a non-privileged user into root. This summarizes the CVE-2026-23111 vulnerability, a use-after-free in the nf_tables subsystem of netfilter for which Exodus Intelligence recently published a complete and functional exploit. The vulnerability was already corrected upstream on February 5, 2026, with a change of just one line, and it's not the first attack code made public: FuzzingLabs had already released an independent reproduction back in April. Ubuntu rates the flaw with a CVSS score of 7.8, high.
The vulnerability does not open any remote gaps, as it is a path an attacker could only take after having already stepped onto the system to promote a low-privileged shell, a compromised container, or a service account to root, thus escaping the isolation towards the host machine.
An Inverted Check in the Abort Phase
The problem lies in nft_map_catchall_activate(), the function that should reactivate the catchall elements of a map during the cancellation of an nf_tables transaction. An inverted activity check, one negation too many, causes the function to skip inactive elements and process active ones, the opposite of what the logic requires. The upstream fix simply removed that character.
The consequence is that with every failed cancelation cycle, the reference counter of a chain is permanently decremented. When brought to zero, it allows the chain to be freed while other objects still reference it, and this is where the exploitable use-after-free opens up for privilege escalation.
The premise is a very common configuration: nf_tables together with unprivileged user namespaces, the feature that allows an ordinary account to act as an administrator inside an isolated sandbox and reach kernel code otherwise out of reach. Both ingredients are enabled by default on most desktops and many server installations.
Two Paths to the Same Root
The two demonstrations took different technical paths. Exodus attributes the discovery to researcher Oliver Sieber, who detected the bug in early 2025 and then chained it into a complete root escalation, complete with an escape from the container namespace. The demonstration worked on Debian Bookworm and Trixie and on Ubuntu 22.04 and 24.04 LTS, with stability over 99% on a resting system, dropping to 80% under heavy kernel memory pressure.
FuzzingLabs arrived earlier and from a different direction: in preparation for Pwn2Own Berlin 2026, it reproduced the bug on Red Hat Enterprise Linux 10, building its exploit up to executing a ROP chain to gain root privileges. The timeline is quite close: upstream fix on February 5, publication by FuzzingLabs on April 16, detailed analysis by Exodus on June 8.
CVE-2026-23111 fits into a dense sequence of local escalations on Linux. In recent weeks, Copy Fail, the Dirty Frag chain along with its variant Fragnesia, DirtyDecrypt, and a nine-year-old ptrace vulnerability capable of reading /etc/shadow and executing commands as root have emerged. According to a recent analysis by Synacktiv, the pace is fueled by AI-assisted research and the comparison between patch versions, which circulates functioning exploits before fixes spread.
The remedy is quite straightforward: update the kernel and reboot. Ubuntu has distributed fixes for 22.04, 24.04, and 25.10; Debian for Bookworm and Trixie with a backport on 6.1 for Bullseye LTS, while Red Hat, SUSE, and Amazon Linux are following the vulnerability with corrected versions varying by distribution. No active exploitations are currently reported, but the attack code has been circulating since last April: where the patch cannot be applied immediately, it is advisable at least to restrict who is authorized to create unprivileged user namespaces.