A Single Missing ‘!’ in nf_tables Triggers Full Root Compromise (CVE‑2026‑23111)

1. Event Overview

CVE‑2026‑23111 is a local privilege escalation vulnerability in the Linux kernel’s netfilter nf_tables subsystem. The flaw resides in the function nft_map_catchall_activate(), where a conditional check is mistakenly negated.

Correct code should skip active elements:

/* nft_mapelem_activate(): skip active elements, handle inactive */
if (nft_set_elem_active(ext, iter->genmask))
    return 0;

The buggy version inverts the test:

/* nft_map_catchall_activate(): skip inactive, handle active — inverted! */
if (!nft_set_elem_active(ext, genmask))
    continue;

The extra ‘!’ flips the abort‑phase logic, turning a harmless check into a use‑after‑free (UAF) that can be exploited.

2. Root Cause: Reversed Abort Logic

nf_tables processes a batch of commands in three phases: Prepare, Commit, and Abort. The vulnerability appears in the Abort path. An attacker crafts a batch containing a valid map deletion followed by a deliberately failing command, forcing the kernel into Abort.

During Abort the kernel calls nft_map_catchall_activate() to reactivate catchall elements. Because the condition is negated, the function skips inactive elements and processes active ones, leaving the catchall element unre‑activated. This prevents the reference count of the associated chain from being restored, causing a permanent decrement of chain->use each time Abort runs. When the count reaches zero, the chain is freed while still referenced, creating a classic UAF scenario.

3. Reproduction Script

The FuzzingLabs team reproduced the UAF using the nft command‑line tool. The essential Bash script is:

nft add table inet mytable
nft add chain inet mytable mychain
nft add map inet mytable mymap { type ipv4_addr : verdict \; }
nft add element inet mytable mymap { * : goto mychain }
nft add map inet mytable triggermap { type ipv4_addr : verdict \; }
nft add element inet mytable triggermap { * : goto mychain }

# Construct a failing batch to trigger Abort
cat > file_bash <<'EOF'
delete map inet mytable triggermap
delete map inet mytable bonjour
EOF
nft -f file_bash

# The reference count is now incorrectly decremented; delete the maps
nft delete map inet mytable mymap
nft delete chain inet mytable mychain

Kernel logs show that nft_map_catchall_activate is invoked but never restores chain->use, and the chain is subsequently freed, leaving corrupted map entries – a clear UAF sign.

4. Exploit Chain: Three‑Step Root Gain

Step 1 – Leak Kernel Base (kbase) : The nft_chain structure resides in the kmalloc‑cg‑128 slab. By reading the name field (allocated from kmalloc‑cg‑32) which points to single_open, the attacker can disclose the kernel base address.

Step 2 – Leak Heap Address (msg_msg‑2k) : The freed nft_chain object is re‑allocated with a controlled pointer in its name field. Using the global init_ipc_ns (type ipc_namespace) the attacker walks the radix tree of message queues to locate the msg_msg‑2k slab, obtaining a heap address.

Step 3 – Build ROP Chain : The attacker overwrites table->name (still in the old nft_chain slot) with a pointer to the leaked heap address plus an offset, then crafts a fake nft_expr structure. When nft_chain_validate validates rules, it calls the forged validate function pointer, launching the ROP chain. The first gadget sets RSI to point to the msg_msg region, enabling stack pivot.

The final ROP payload overwrites modprobe_path to gain root, clears selinux_state.enforcing to bypass SELinux, and calls msleep to trigger the modified modprobe_path. Full root privileges are obtained.

5. Impact and Mitigation

The vulnerability affects distributions with CONFIG_USER_NS and CONFIG_NF_TABLES enabled – essentially all mainstream Linux kernels. An unprivileged user can exploit it via a user namespace combined with nftables. FuzzingLabs verified the exploit on Red Hat kernel 6.12.0‑124.38.1.el10_1.

Mitigation : Upgrade to a kernel containing commit 8fdb05de0e2d. If immediate upgrade is not possible, temporarily disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0.

6. Conclusion

A missing exclamation mark in the abort‑phase check of nf_tables demonstrates how a tiny logic error can collapse the kernel’s security boundary, providing a ready‑to‑use n‑day exploit for attackers and a stark reminder for operators to apply patches promptly.