Linux kernel use-after-free flaws enable local privilege escalation to root

Two Linux kernel use-after-free vulnerabilities were disclosed in packet-filtering components, exposing systems to local privilege escalation. CVE-2026-23111 affects the nftables subsystem and stems from an inverted conditional in nft_map_catchall_activate() that mishandles catchall elements during transaction aborts, leaving a dangling chain reference. A public technical write-up and working exploit showed the bug can achieve root privileges with high reliability on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS by corrupting chain reference counts, bypassing KASLR, leaking heap addresses, hijacking control flow with a fake nft_expr_ops structure, and executing a ROP chain that calls commit_creds(&init_cred). The exploit also uses switch_task_namespaces() to break out of namespaces and containers.

A separate flaw, CVE-2026-23412, affects the Linux kernel’s BPF netfilter link implementation in nf_bpf_link.c, where synchronous deallocation of bpf_nf_link_lops allowed concurrent nfnetlink hook enumeration to access freed memory during BPF link destruction. Researchers reproduced KASAN slab-use-after-free crashes in nfnl_hook_dump_one on kernel 6.14.0 and said the bug could be exploited through heap spraying and function-pointer hijacking in the kmalloc-192 slab cache. The issue was introduced in 6.4-rc1 and fixed in 7.0-rc5 by commit 24f90fa3994b, which switches to RCU-deferred freeing, while the nftables bug was patched upstream by commit f41c5d1; administrators were urged to deploy patched kernels promptly.