One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public
A critical vulnerability, CVE-2026-23111, has been discovered in the Linux kernel’s nf_tables packet-filtering code, allowing unprivileged users to escalate to root access and break out of containers. The flaw, initially found by Exodus Intelligence and independently reproduced by FuzzingLabs, has been publicly exploited since April, highlighting a surge in local privilege escalation vulnerabilities. Security teams are urged to update their kernels immediately to mitigate the risk.
The vulnerability, CVE-2026-23111, is a use-after-free bug within the nf_tables code, a common component in many Linux distributions. The issue stems from a single character – an inverted check – that allowed an attacker to bypass kernel memory protections and gain root privileges. The flaw was initially identified by Oliver Sieber at Exodus Intelligence in early 2025 and subsequently replicated by FuzzingLabs ahead of the Pwn2Own Berlin 2026 competition. The timeline of discovery and patching is remarkably tight, with the fix released on February 5th, the public reproduction by FuzzingLabs on April 16th, and the detailed write-up by Exodus Intelligence on June 8th. The exploit leverages the combination of nf_tables and unprivileged user namespaces, a feature that allows a regular user to operate as root within a sandbox. This combination creates a pathway for attackers to gain root access after establishing a foothold, such as through a compromised container or service account. Recent weeks have seen a surge in similar local privilege escalation vulnerabilities, including Copy Fail, Dirty Frag, and others, further emphasizing the need for proactive security measures.