PoC Archive PoC Archive
CVE-2026-23111 category: binary CVSS 7.8 (HIGH)
Unverified

Linux nf_tables Catchall Set Element UAF -- Local Privilege Escalation (CVE-2026-23111)

Published: 2026-08-16 • Researcher: Knz-source

Target software Linux kernel (nf_tables subsystem)
Affected versions 6.13-6.18.9, 6.7-6.12.69, 6.1.36-6.1.162, 5.15.121-5.15.199, 5.10.188+
Status Patched
Severity High · CVSS 7.8
CVSS 7.8/10
Severity
High
CVE
CVE-2026-23111
Category
binary
Affected product
Linux kernel (nf_tables subsystem)
Affected versions
6.13-6.18.9, 6.7-6.12.69, 6.1.36-6.1.162, 5.15.121-5.15.199, 5.10.188+
Disclosed
2026-08-16
Patch status
Unverified

Archive entry

intelseclab/poc-archive
On this page

Metadata

FieldValue
Date Added2026-08-16
Last Updated2026-08-16
Author / ResearcherKnz-source
CVE / AdvisoryCVE-2026-23111
Categorybinary
SeverityHigh
CVSS Score7.8 (local privilege escalation)
StatusPatched
Tagslinux, kernel, nftables, nf-tables, uaf, catchall, lpe, privilege-escalation, slab-spray, kaslr-bypass, rop, namespace, CVE-2026-23111

Affected Target

FieldValue
Software / SystemLinux kernel (nf_tables subsystem)
Versions Affected6.13-6.18.9, 6.7-6.12.69, 6.1.36-6.1.162, 5.15.121-5.15.199, 5.10.188+
Language / PlatformC, Python, Rust (x86-64 Linux)
Authentication RequiredNone – unprivileged user with user namespace access (unshare -rUn)
Network Access RequiredNone – local exploitation

Summary

CVE-2026-23111 is a use-after-free in the Linux nf_tables subsystem caused by an inverted genmask check in nft_map_catchall_activate(). During transaction abort, the handler skips inactive catchall elements that need reactivation and processes active ones that do not, causing chain->use to decrement incorrectly. This allows DELCHAIN on a still-referenced chain, creating a UAF. The exploit auto-adapts to the target kernel via BTF/pahole offset extraction and ROP gadget discovery, achieving unprivileged user-to-root on kernels 5.10-6.18 across major distributions.

Vulnerability Details

Root Cause

In nft_map_catchall_activate():

C source 
1
2
3
4
5
6

// WRONG -- skips elements needing reactivation
if (!nft_set_elem_active(ext, genmask))
    continue;
// CORRECT -- skips already-active elements
if (nft_set_elem_active(ext, iter->genmask))
    return 0;

Attack Flow

  1. Namespace setup: unshare -rUn for user + network namespaces
  2. UAF trigger: Batch delete + failing rule -> abort -> gencursor flip -> chain freed while referenced
  3. KASLR bypass: seq_operations spray into freed chain name, leak kernel base via getrule
  4. Kernel read: Table userdata spray, read arbitrary addresses via getrule chain name
  5. Task walk: Find current task, read canary and cred pointer
  6. ROP: commit_creds(init_cred) via pivot gadget in forged nft_rule_blob

Impact

  • Unprivileged user-to-root on Debian 11/12, Ubuntu 22.04/24.04, RHEL 9+, Fedora 39+, Arch
  • Works inside containers (root in container namespace)
  • Only requires unshare -rUn

Environment / Lab Setup

Shell script 
1
2
3
4
5
6
7

python3 autopwn.py

python3 checker.py --detailed
python3 scripts/extract_offsets.py
python3 scripts/find_gadgets.py
make
./exploit

Proof of Concept

Source from Knz-source/CVE-2026-23111-POC-noddlenpottato.

Key Files

FilePurpose
autopwn.pyFull auto – detect, extract offsets, compile, exploit
checker.pyVulnerability checker
exploit_61.cBase exploit for Debian 6.1.172
exploit/exploit.cMain C exploit
exploit/exploit.rsRust port (static musl binary)
scripts/Offset extractor, gadget finder, slab checker

Expected Output

Output 
$ ./exploit
[*] CVE-2026-23111 nftables UAF -> LPE
[+] chain freed (kmalloc-128) + name freed (kmalloc-32)
[pwn] kbase = 0xffffffff9a400000
[pwn] commit_creds(init_cred) -> ROP triggered
[+] root
uid=0(root) gid=0(root) groups=0(root)

Detection and Indicators of Compromise

Output

Remediation

ActionDetail
PatchUpdate kernel: 6.18.10+, 6.12.70+, 6.1.163+, 5.15.200+.
WorkaroundDisable unprivileged user namespaces or blacklist nf_tables.
Verificationpython3 checker.py –detailed

References

Notes

All source files screened: autopwn.py, checker.py, exploit_61.c, exploit/exploit.c, exploit/exploit.py, exploit/exploit.rs, scripts/, Makefile, build.sh. Pure C/Python/Rust kernel exploit. No obfuscation, no remote connections, no callbacks. No committed binaries – PNG diagrams only. Bilingual documentation (EN/PT). Auto-adaptation via BTF/pahole handles cross-distro differences. Key slab size varies (kmalloc-128 vs kmalloc-192), pivot gadget register varies (rbp in 6.1.x, rbx in 6.5+).