Skip to main content

Linux CVE-2026-23111

HIGH
Use After Free (CWE-416)
2026-02-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Privilege Escalation Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Local access with user privileges
  2. Delivery
    Trigger nf_tables transaction
  3. Exploit
    Invoke nft_map_catchall_activate()
  4. Execution
    Corrupt kernel memory state
  5. Impact
    Escalate privileges or crash system

Vulnerability Assessment

Weakness
CWE
CWE-416
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Linux kernel with nf_tables module loaded and user-level netlink access to nf_tables (requires CAP_NET_ADMIN or equivalent local user privileges). Exploitation requires ability to invoke failed nf_tables transactions targeting map catchall elements.
Impact

Exploitable via local access.
Exploit ScenarioDerived

An attacker could exploit this flaw, a use-after-free.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

A use-after-free vulnerability in the Linux kernel's netfilter nf_tables module allows local attackers with unprivileged access to cause memory corruption and denial of service through an inverted logic check in catchall map element activation during failed transactions. The flaw occurs in nft_map_catchall_activate() which incorrectly processes already-active elements instead of inactive ones, potentially leading to privilege escalation or system crash. No patch is currently available.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 22:02 CVSS 7.8

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required.

RemediationAI

Monitor vendor advisories for a patch.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required.

nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.0 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch released
Apr 02, 2026 - 19:01 nvd
Patch available
CVE Published
Feb 13, 2026 - 14:16 nvd
HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft_mapelem_activate() and compared to what is logically required.

nft_map_catchall_activate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones.

Compare the non-catchall activate callback, which is correct:

nft_mapelem_activate(): if (nft_set_elem_active(ext, iter->genmask)) return 0; /* skip active, process inactive */

With the buggy catchall version:

nft_map_catchall_activate(): if (!nft_set_elem_active(ext, genmask)) continue; /* skip inactive, process active */

The consequence is that when a DELSET operation is aborted, nft_setelem_data_activate() is never called for the catchall element. For NFT_GOTO verdict elements, this means nft_data_hold() is never called to restore the chain->use reference count. Each abort cycle permanently decrements chain->use. Once chain->use reaches zero, DELCHAIN succeeds and frees the chain while catchall verdict elements still reference it, resulting in a use-after-free.

This is exploitable for local privilege escalation from an unprivileged user via user namespaces + nftables on distributions that enable CONFIG_USER_NS and CONFIG_NF_TABLES.

Fix by removing the negation so the check matches nft_mapelem_activate(): skip active elements, process inactive ones.

Executive ViewAI

Why It Matters

CVE-2026-23111 presents notable security risk, a use-after-free vulnerability rated CVSS 7.8. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.

Threat Intelligence Overview

Threat Score
5.1/10
Composite threat intelligence
EPSS Score
0.0%
Top 91% exploitable
Threat Intel
3
1 source
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
NVD CVE.org EPSS CISA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

69
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Affected Products (CPE)NVD

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.105 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.124 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.67 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.90 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-188-05 ICSA-26-209-04 ICSA-26-295-11
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:6570 ADVISORY https://ubuntu.com/security/notices/USN-8148-1 ADVISORY https://ubuntu.com/security/notices/USN-8149-1 ADVISORY https://vuldb.com/?id.345901 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0962/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1041/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1081/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1180/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1185/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1187/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1188/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1189/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1225/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20667/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20711/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20713/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20720/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20838/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20873/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20931/ REF https://access.redhat.com/errata/RHSA-2026:10108 REF https://access.redhat.com/errata/RHSA-2026:10996 REF https://access.redhat.com/errata/RHSA-2026:18134 REF https://access.redhat.com/errata/RHSA-2026:62639 REF https://access.redhat.com/errata/RHSA-2026:62641 REF https://access.redhat.com/errata/RHSA-2026:9112 REF https://access.redhat.com/security/cve/CVE-2026-23111 REF https://blog.exodusintel.com/2026/06/08/off-by-exploiting-a-use-after-free-in-the-linux-kernel/ REF https://bugzilla.redhat.com/show_bug.cgi?id=2439687 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://cert-portal.siemens.com/productcert/html/ssa-253495.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://git.kernel.org/stable/c/1444ff890b4653add12f734ffeffc173d42862dd REF https://git.kernel.org/stable/c/42c574c1504aa089a0a142e4c13859327570473d REF https://git.kernel.org/stable/c/8b68a45f9722f2babe9e7bad00aa74638addf081 REF https://git.kernel.org/stable/c/8c760ba4e36c750379d13569f23f5a6e185333f5 REF https://git.kernel.org/stable/c/b9b6573421de51829f7ec1cce76d85f5f6fbbd7f REF https://git.kernel.org/stable/c/f41c5d151078c5348271ffaf8e7410d96f2d82f8 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23111.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy