Public Exploit Drops for nf_tables UAF: CVE-2026-23111 Gives Local Root, Container Escape

A working exploit for CVE-2026-23111 is now public, and defenders running unpatched Linux kernels need to move.

The bug is a use-after-free in the kernel's nf_tables subsystem — the same packet-filtering code that has been a reliable source of local privilege escalation for years. An unprivileged local user can trigger the UAF, win the race, and land a root shell. The same primitive breaks out of containers that don't drop CAP_NET_ADMIN in a user namespace (which, in practice, is most Kubernetes default configurations and a lot of CI runners).

Upstream patched it on February 5, 2026. Exodus Intelligence released the full technical walkthrough on June 8, roughly four months later — long enough for downstream distros to ship fixed packages, short enough that plenty of long-lived hosts haven't rebooted into them.

The exploit itself is not a script-kiddie artifact. The writeup details heap grooming against the kmalloc-cg caches, a cross-cache attack to land a controllable object on top of the freed nft_* structure, and a pivot through modprobe_path for the final root payload. It is reliable on stock kernels with KASLR and SMAP enabled. SMEP doesn't help here because the corruption stays in kernel memory.

A few things worth flagging:

• The bug reaches back several LTS branches. If your fleet still has 5.15 or 6.1 hosts that haven't picked up the February stable update, assume vulnerable.
• User-namespace-gated CAP_NET_ADMIN is the reachability requirement. Distros that disable unprivileged user namespaces (Debian's kernel.unprivileged_userns_clone=0, or equivalent sysctls) cut off the unprivileged path. Containers running as root inside the namespace are still exposed.
• There is no CVSS dispute worth having. This is local privilege escalation with a public weaponized exploit. Treat it as critical regardless of the score string your scanner prints.

Mitigations, in order of preference: patch to the stable kernel that contains the February 5 fix (check your distro's advisory for the exact build string — don't trust uname alone if you're using livepatching), disable unprivileged user namespaces where workloads tolerate it, and audit container runtimes to confirm CAP_NET_ADMIN is dropped by default.

For detection, the exploit's cross-cache spray is noisy if you're collecting kernel allocator telemetry, but most shops aren't. More realistically: watch for unexpected modprobe invocations from non-root parents, and for processes transitioning UID to 0 without going through a known setuid path. Falco and auditd rules covering both are straightforward to write.

The patch is a few lines. The cleanup, as always, is the slow part.