Researchers at Exodus Intelligence posted an illustrated step-by-step way to do a use-after-free attack on Linux which gives an unprivileged local user root privileges and allows escape from a container.
The bug was identified as CVE-2026-23111. It exists within nf_tables, the kernel's packet filtering system. It was fixed upstream on February 5, 2026. On June 8, Exodus released their full technical documentation for how they made an exploit (a program) to take advantage of the bug. Additionally, another exploit was developed independently by Fuzzing Labs in April.
A single misplaced character, an inverted check in nf_tables, is responsible for the vulnerability. This check was removed with a single line of code in the upstream fix. Ubuntu rated the vulnerability as CVSS 7.8 (High).
If you haven't already updated your kernel packages and rebooted, please do so. You don't need a network connection. A simple "apt-get update && apt-get upgrade --yes", followed by a "reboot" will be sufficient.
This particular vulnerable configuration is pretty common: nf_tables combined with unprivileged user namespaces. User namespaces are a feature of Linux that allows a normal user to impersonate "root" while running in a completely isolated environment, accessing and executing kernel code that would normally be inaccessible due to privilege separation.
User namespaces are included by default on most desktops and many server configurations. The vulnerability cannot be exploited remotely. Rather, this is an example of an attacker using the bug once they have already gained access locally (via some other means), such as having received a shell with low-privilege user rights (for example, via SSH), being able to compromise a container running with a non-root user, and wanting to elevate permissions to root on the underlying host.
Oliver Sieber, a researcher at Exodus Intelligence, discovered the bug in late 2025. He created a fully functional local root exploit using the bug. His exploit creates a use-after-free, gets around the memory protection mechanisms in place within the kernel, and takes over execution, allowing him to obtain root privileges and break out of the container's user namespace.
Sieber tested his exploit successfully against:
- Debian Bookworm
- Debian Trixie
- Ubuntu 22.04 LTS
- Ubuntu 24.04 LTS
Before attending Pwn2Own Berlin in June 2026, Fuzzing Labs also recreated the bug on RHEL 10 and built its own root exploit using a different sequence of steps than Sieber.
As the timing shows, the fix for the bug was issued upstream on February 5, Fuzzing Labs published its own reproduction of the bug on April 16, and Exodus' detailed writeup appeared on June 8.
Given that the bug resides in the mainline kernel, all distributions that shipped kernels containing both nf_tables and unprivileged user namespaces will be vulnerable unless those distributions implement additional hardening or namespace restrictions to prevent the exploit path.
CVE-2026-23111 arrives during a long string of recent Linux local-root vulnerabilities. Those vulnerabilities include Copy Fail, the Dirty Frag chain (and its Fragnesia variant), DirtyDecrypt, and a nine-year-old ptrace flaw that reads /etc/shadow and executes commands as root. They each differ in detail, but they share a point that should concern security practitioners: there appears to be no limit to how often an unprivileged foothold can turn into root on an ordinary install.
Please update your kernel and reboot. The bug is local-only and requires unprivileged user namespaces, so please first address systems which allow untrusted users or workloads to create them.
Ubuntu has patches available for 22.04, 24.04 and 25.10, while Debian has patches available for Bookworm and Trixie, along with a backported 6.1 for Bullseye LTS. Red Hat, SUSE, and Amazon Linux all track this issue as well. Verify your distribution's advisory to determine which kernel package corresponds to your installation, as the exact version number of the patched kernel may vary.
The upstream fix was one line of code.
There is a larger story here as well. Recently Synacktiv authored a blog post detailing why they believe we are seeing an uptick in LPEs (Local Privilege Escalation), caused largely by two factors: first, AI-assisted research allowing attackers to find vulnerabilities quickly, typically faster than vendors can issue fixes, and second, patch diffing tools making it easier for researchers to build functioning exploits prior to widespread patch deployment. Synacktiv further suggests that standard security practices can provide attackers with only a delay.
In nearly every one of these bugs, the optional nature of the involved kernel features or looser defaults are used as paths for the attacker to follow until the vendor issues a patch. Cutting off what unprivileged users can reach, specifically user namespaces in this example, delays when an attacker can execute the exploit until after the patch is deployed.
At present, there are no public reports of attacks occurring in the wild. No attacker group has claimed credit for exploiting this vulnerability. Independent reproduction of the bug has been confirmed by Fuzzing Labs.
