One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public
Summary: Researchers have published a working exploit for CVE-2026-23111, a use-after-free in the Linux kernel's nf_tables packet-filtering code that lets an unprivileged local user escalate to root and break out of a container; the flaw came down to a single inverted check, and the upstream fix removed it in one line on February 5, 2026. Exodus Intelligence released its full technical walkthrough on June 8, after FuzzingLabs published an independent reproduction on April 16, and Exodus researcher Oliver Sieber demonstrated the exploit on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
Key Takeaway: The exploit needs nf_tables plus unprivileged user namespaces, both of which ship by default on most desktops and many server builds, so any distribution that shipped a vulnerable kernel with both features enabled is exposed unless hardening or namespace restrictions block the path. The patch has been out since February and exploit code has been public since April, with no reports of in-the-wild exploitation and no threat actor tied to it.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-23111
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026