Loading story…
Two Linux kernel use-after-free vulnerabilities were disclosed in packet-filtering components, exposing systems to local privilege escalation. CVE-2026-23111 affects the nftables subsystem and stems from an inverted conditional in nft_map_catchall_activate() that mishandles catchall elements during transaction aborts, leaving a dangling chain reference. A public technical write-up and working exploit showed the bug can achieve root privileges with high reliability on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS by corrupting chain reference counts, bypassing KASLR, leaking heap addresses, hijacking control flow with a fake nft_expr_ops structure, and executing a ROP chain that calls commit_creds(&init_cred). The exploit also uses switch_task_namespaces() to break out of namespaces and containers.
A separate flaw, CVE-2026-23412, affects the Linux kernel’s BPF netfilter link implementation in nf_bpf_link.c, where synchronous deallocation of bpf_nf_link_lops allowed concurrent nfnetlink hook enumeration to access freed memory during BPF link destruction. Researchers reproduced KASAN slab-use-after-free crashes in nfnl_hook_dump_one on kernel 6.14.0 and said the bug could be exploited through heap spraying and function-pointer hijacking in the kmalloc-192 slab cache. The issue was introduced in 6.4-rc1 and fixed in 7.0-rc5 by commit 24f90fa3994b, which switches to RCU-deferred freeing, while the nftables bug was patched upstream by commit f41c5d1; administrators were urged to deploy patched kernels promptly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The new report states that testing confirmed CVE-2026-23111 affects RHEL 10 in addition to previously reported Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS systems. The article also notes Ubuntu and Debian have issued patches while other vendors are tracking the flaw.
The reference states that FuzzingLabs published a reproduction of the CVE-2026-23111 exploit in April 2026, making exploit details publicly available before the later June 8 technical walkthrough by Exodus Intelligence. This represents an earlier public technical disclosure related to the flaw.
CVE-2026-23111 was publicly disclosed with a technical write-up and working exploit demonstrating root privilege escalation and namespace breakout. The disclosure reported impact on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS.
Oliver Sieber of Exodus Intelligence discovered a local privilege escalation vulnerability in the Linux kernel nftables subsystem in early 2025. The bug is a use-after-free tied to mishandling of catchall elements during transaction aborts.
Aretiq AI published research describing CVE-2026-23412 as a Linux kernel local privilege escalation vulnerability affecting the BPF netfilter link implementation. The write-up said the issue was reproducible on kernel 6.14.0 and exploitable via heap spraying and function pointer hijacking.
A use-after-free flaw in the Linux kernel's BPF netfilter link implementation, tracked as CVE-2026-23412, was fixed in kernel 7.0-rc5 by commit 24f90fa3994b. The change deferred freeing with RCU to prevent concurrent hook enumeration from accessing freed memory.
The Linux kernel upstream patched CVE-2026-23111 on 2026-02-05. The fix is identified as commit f41c5d1, and administrators were advised to deploy patched kernels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcesecurityaffairs.com
Open sourcethecybersecguru.com
Open sourcecysecurity.news
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcearetiq.ai
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed exploitation of **CVE-2023-31248** in the Linux kernel's `nftables` subsystem, showing how a chain lookup flaw can let local attackers gain root privileges. The bug exists because `nft_chain_lookup_byid` did not verify whether a chain was still active through `genmask` checks, allowing rules in a batch transaction to reference chains deleted in the same batch. That logic error can trigger a **use-after-free** when rule deletion in the control plane races with asynchronous transaction-worker cleanup, creating a path to reclaim freed memory and corrupt kernel objects. The write-up demonstrates an exploit on **Ubuntu 23.04** with kernel `6.2.0-20-generic`, using heap sprays and information leaks to recover kernel text and heap addresses before forging `nftables` structures and building a ROP chain that invokes `prepare_kernel_cred` and `commit_creds` to obtain a root shell. Researchers said kernels before `6.2.0-26-generic` were vulnerable, while upstream fixes added `genmask` validation to chain-by-ID lookups so inactive chains cannot be referenced. The same research also described a separate dormant-state chain hook deactivation bug that can trigger kernel warnings but was assessed as not practically exploitable and patched by blocking repeated dormant-state toggles within a single batch.
Jun 29, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Jul 11, 2026
Two Linux kernel vulnerabilities, **CVE-2026-53362** and **CVE-2026-53366**, were disclosed in the UDP packet handling path and can allow a local unprivileged user to escalate privileges to root. The flaws affect the IPv6 UDPv6 path and the IPv4 UDP path when `MSG_SPLICE_PAGES` is used with UDP corking and a datagram crosses a fragment boundary, causing a heap out-of-bounds write. Researchers said incorrect `fraggap` accounting lets validation be bypassed, leading to corruption of `skb_shared_info` metadata and manipulation of the `nr_frags` field, which can ultimately produce a use-after-free condition exploitable for local privilege escalation. The bugs affect Linux kernels from **v6.1 onward**. The IPv6 issue requires `CONFIG_IPV6=y`, while the IPv4 variant also depends on access conditions tied to user namespaces. Fixes were published in upstream commits `736b380e28d0` for IPv6 and `eca856950f7c` for IPv4, and were released in stable kernel versions including **7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177**. Advisories or updates were issued by major distributions including **Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, and Fedora**.
Jul 23, 2026