Linux kernel nf_tables catchall map use-after-free

This seven-file repository is a C proof-of-concept local privilege-escalation exploit for CVE-2026-23111 in the Linux nf_tables subsystem, tested against Linux 6.12.69 on x86-64. The primary entry point, exp.c, creates an unprivileged user and network namespace, drives nftables through NETLINK_NETFILTER messages, and implements a four-stage chain: reclaiming a freed nft_chain to leak single_start and defeat KASLR; using a dangling GOTO verdict to read arbitrary kernel memory; locating a controlled System V message allocation by traversing init_ipc_ns message-queue xarray state; and reclaiming the vulnerable chain with fake nft_rule/nft_expr_ops data plus a kernel ROP chain. The final chain overwrites modprobe_path with /tmp/x and triggers the kernel module-loader helper flow to obtain root execution. rootme.c is a minimal setuid/setgid root-shell helper. offsets.h contains kernel-build-specific symbols and gadgets, while gen_offsets.sh regenerates them from System.map/vmlinux and optionally ROPgadget output. netlink_min.h supplies musl-compatible netlink definitions, and the Makefile builds static musl binaries for a minimal initramfs environment.

This repository is a real local privilege escalation PoC for CVE-2026-23111 in Linux nf_tables. It contains one substantive code file, exp.c, plus README and detailed exploitation notes. The exploit is not part of a larger framework. Repository structure: README.md identifies the vulnerability, prerequisites, and references; exp.c implements the exploit; notes/notes.md documents compilation, environment setup, debugging, and the exploitation strategy in depth. The single entry point is exp.c::main(). Exploit purpose and flow: the code targets an inverted logical check in nft_map_catchall_activate() that causes nft_chain->use reference counts not to be restored when a DELSET transaction aborts. The exploit abuses this to create a use-after-free in an nft_chain object reachable through nftables rule references. The implementation is organized into three phases invoked from main(): phase1 leaks a kernel text pointer to derive kernel base/KASLR bypass, phase2 leaks a kernel heap address, and phase3 builds a kernel ROP chain to obtain code execution and elevate privileges. Capabilities: the exploit opens a NETLINK_NETFILTER socket via libmnl/libnftnl and programmatically creates/manipulates nftables tables, chains, rules, and sets/maps. It performs transactional netlink operations to trigger the vulnerable DELSET abort path, uses object spraying (including seq_operations and System V message queues per the notes and visible structures/constants) to reclaim freed memory, leaks kernel pointers from reused allocations, computes kernel base and heap addresses, and finally triggers a ROP chain. On success it returns to userland and executes /bin/sh as root. Notable implementation details visible in exp.c: hardcoded nftables object names for multiple phases; constants for large sprays (NUM_SEQOPS 512, NUM_MSQIDS 4096); System V message queue structures for heap shaping and fake object/ROP placement; save_state()/get_shell() helpers for returning from kernel context; repeated system("nft flush ruleset") cleanup between phases; and a final shell spawn through system("/bin/sh"). The notes indicate the ROP chain is kernel-build-specific, so this is an operational PoC rather than a broadly portable weaponized exploit. There are no external C2 or remote network endpoints. The only meaningful endpoints are local kernel interfaces and shell commands: NETLINK_NETFILTER communication with nf_tables, nft command invocations, and local file paths such as /bin/sh and /etc/shadow referenced as post-exploitation artifacts.

Repository contains a local Linux kernel exploit and a companion checker for CVE-2026-23111, an nf_tables use-after-free in nft_map_catchall_activate(). Structure is small and focused: one Python checker, two C exploit implementations, a Makefile, and documentation. The checker script is a detection/triage utility that parses kernel versions, checks nft availability, inspects module/config/symbol state, and scores exploitation risk; it is not the exploit itself. The main exploit logic is in exploit.c and exploit_full.c. exploit.c is a PoC-style but still offensive local exploit that uses libmnl/libnftnl to talk to the kernel over NETLINK_NETFILTER and manipulate nftables objects. It creates tables/chains/sets, triggers the UAF via transaction abort behavior around a catchall element, then performs slab reclamation and information disclosure. The documented phases are: (1) trigger UAF on struct nft_chain, (2) reclaim freed chain->name with seq_operations objects by opening /proc/self/stat to leak kernel pointers and defeat KASLR, and (3) reclaim a larger freed allocation with nft_rule objects to leak heap/direct-map addresses. The code summary indicates it resolves useful kernel symbols and gadgets where possible, but stops short of a fully generic privilege-escalation chain. exploit_full.c is the full local privilege escalation implementation. It is explicitly tuned for Ubuntu 24.04 kernel 6.8.0-117-generic and includes hardcoded structure offsets plus logic to read /proc/kallsyms and scan /proc/kcore for gadgets. It reuses the same UAF and leak primitives, then sprays fake nftables-related structures, overwrites pointers used by nftables rule evaluation, and redirects execution into a kernel ROP chain. The intended end state is root privileges via commit_creds(&init_cred), followed by namespace switching and return to user mode. This makes the repository more than a simple detector or crash PoC: it contains a practical LPE chain, though target-specific and dependent on kernel layout/gadget availability. No external C2 or remote network infrastructure is present. The attack vector is purely local. The only meaningful interfaces/endpoints are local kernel/userland resources: NETLINK_NETFILTER, /proc/modules, /proc/config.gz, /boot/config-*, /proc/kallsyms, /proc/kcore, /proc/self/stat, and mitigation path /etc/modprobe.d/nf_tables.conf. Overall, this is a genuine local privilege escalation exploit repository with both a vulnerability checker and a more complete Ubuntu-targeted exploitation path.