Linux Kernel Privilege Escalation Vulnerability (CVE-2024-XXXX) Found

Key Takeaways

• A critical use-after-free vulnerability (CVE-2026-23111) has been identified in the Linux kernel’s nftables subsystem.
• This flaw allows unprivileged local attackers to achieve root privilege escalation on several prominent Linux distributions, including Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
• The vulnerability was patched upstream on February 5, 2026, and a highly reliable exploit demonstrating root access is publicly available.
• Immediate patching or kernel updates are strongly recommended for affected systems.

A significant privilege escalation vulnerability, tracked as CVE-2026-23111, has been discovered within the nftables subsystem of the Linux kernel. This use-after-free flaw enables local attackers without elevated privileges to gain root access on widely used Linux distributions. Affected versions include Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.

The vulnerability was initially identified in early 2025 and subsequently addressed upstream through a kernel commit on February 5, 2026. Security researcher Oliver Sieber of Exodus Intelligence has since published a comprehensive technical analysis, accompanied by a functional exploit achieving over 99% reliability on systems with minimal load.

Technical Details of the Flaw

The root cause of the bug lies within the nft_map_catchall_activate() function of the nftables subsystem, which is a packet filtering framework built upon Linux’s Netfilter hooks. Specifically, an erroneous inverted conditional check, involving a misplaced ‘!’ operator, causes the function to bypass inactive catchall elements during an abort process, rather than reactivating them as intended.

This critical oversight manifests when a pipapo-backed verdict map, which contains a catchall element referencing a chain, is deleted. If a subsequent transaction within the same batch fails, triggering an abort, the catchall element incorrectly remains inactive. Consequently, the reference counter for the associated chain drops to zero, despite a valid reference to that chain still existing elsewhere. An attacker can then exploit this state by deleting the chain, while a dangling pointer persists within a base chain rule, thereby creating a use-after-free condition.

Exploitation Chain and Impact

The exploit developed by Oliver Sieber leverages a sequence of four transaction batches to manipulate nftables’ generational cursor mechanism, leading to arbitrary code execution and privilege escalation:

• Batch 1: Deletes the pipapo set, then forces an error to trigger an abort, which incorrectly decrements the chain’s reference counter.
• Batch 2: Sends a benign transaction to toggle the generation cursor.
• Batch 3: Cleans up the pipapo set, driving the chain’s reference counter to zero.
• Batch 4: Deletes the chain, even though a live rule in the base chain still references it, establishing the use-after-free state.

Following the use-after-free, the exploit proceeds to bypass Kernel Address Space Layout Randomization (KASLR). It reclaims the freed kmalloc-cg-32 slab using a seq_operations structure, populated by opening /proc/self/stat, to leak kernel function pointers via an NFT_MSG_GETRULE request. Heap addresses are then revealed by reclaiming freed kmalloc-cg-192 objects with specially crafted nft_rule structures, whose linked-list pointers are exfiltrated using the same method.

Control flow hijacking is achieved by overwriting the deleted chain’s blob_gen_0 pointer with a fabricated nft_expr_ops structure, which points to a Return-Oriented Programming (ROP) gadget (push rbx; pop rsp). The final ROP chain executes commit_creds(&init_cred) to acquire root credentials, followed by switch_task_namespaces() to escape namespace isolation, achieving a full container and namespace breakout. On Ubuntu 24.04, AppArmor restrictions on namespace creation can be circumvented using aa-exec -p trinity -- unshare -Urmin /bin/sh before initiating the exploit.

The exploit’s reliability is notable, achieving greater than 99% success on idle systems and approximately 80% under significant heap pressure, such as during an Apache benchmark via the Phoronix Test Suite, as Oliver Sieber stated.

It is important to note that the same break statement responsible for this vulnerability also introduced a related bug, CVE-2026-23278, which was patched separately via a second kernel commit.

What You Should Do

• Apply Patches Immediately: System administrators should prioritize applying the upstream kernel patch (commit f41c5d1) or update to a patched kernel release provided by their respective distribution vendors as soon as possible.
• Restrict User Namespace Creation: On Ubuntu systems, a partial mitigation involves restricting unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0. This should be implemented where organizational policy permits, as it can impact certain containerized workloads.
• Monitor for Updates: Regularly monitor official advisories from Debian, Ubuntu, and other Linux distribution maintainers for further updates and guidance regarding this vulnerability.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.