Linux nftables flaw CVE-2023-31248 enables local root via use-after-free

Researchers detailed exploitation of CVE-2023-31248 in the Linux kernel's nftables subsystem, showing how a chain lookup flaw can let local attackers gain root privileges. The bug exists because nft_chain_lookup_byid did not verify whether a chain was still active through genmask checks, allowing rules in a batch transaction to reference chains deleted in the same batch. That logic error can trigger a use-after-free when rule deletion in the control plane races with asynchronous transaction-worker cleanup, creating a path to reclaim freed memory and corrupt kernel objects.

The write-up demonstrates an exploit on Ubuntu 23.04 with kernel 6.2.0-20-generic, using heap sprays and information leaks to recover kernel text and heap addresses before forging nftables structures and building a ROP chain that invokes prepare_kernel_cred and commit_creds to obtain a root shell. Researchers said kernels before 6.2.0-26-generic were vulnerable, while upstream fixes added genmask validation to chain-by-ID lookups so inactive chains cannot be referenced. The same research also described a separate dormant-state chain hook deactivation bug that can trigger kernel warnings but was assessed as not practically exploitable and patched by blocking repeated dormant-state toggles within a single batch.