CVE-2026-23111 with a CVSS score of 7.8 is a use-after-free vulnerability in the Linux kernel’s nf_tables component of the Netfilter packet filter. The flaw occurs in nft_map_catchall_activate(), which handles rollback of a failed nf_tables transaction, because an inverted genmask check causes inactive catchall map elements to be processed incorrectly. Each aborted delete operation can lower a chain’s reference count without restoring it, allowing the kernel to free the chain while map elements still reference it. The affected versions are stated as Linux 6.4 through 6.19, with backports into older stable branches starting with 5.15.121 and 6.1.36. A local attacker with CAP_NET_ADMIN, a capability that unprivileged user namespaces can provide to ordinary users on many systems, can exploit the bug by reclaiming freed chain memory, escalating a slab-level use-after-free to page-level corruption, corrupting page tables for physical memory read and write access, and ultimately executing code as root outside a container. The business impact is severe for shared hosts and container platforms, where successful exploitation can lead to full host compromise, data exposure, and loss of isolation.
We recommend you to update Linux to version 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10, or 6.19 .[/subscribe_to_unlock_form]
CVE-2026-23111 with a CVSS score of 7.8 is a use-after-free vulnerability in the Linux kernel’s nf_tables component of the Netfilter packet filter. The flaw occurs in nft_map_catchall_activate(), which handles rollback of a failed nf_tables transaction, because an inverted genmask check causes inactive catchall map elements to be processed incorrectly. Each aborted delete operation can lower a chain’s reference count without restoring it, allowing the kernel to free the chain while map elements still reference it. The affected versions are stated as Linux 6.4 through 6.19, with backports into older stable branches starting with 5.15.121 and 6.1.36. A local attacker with CAP_NET_ADMIN, a capability that unprivileged user namespaces can provide to ordinary users on many systems, can exploit the bug by reclaiming freed chain memory, escalating a slab-level use-after-free to page-level corruption, corrupting page tables for physical memory read and write access, and ultimately executing code as root outside a container. The business impact is severe for shared hosts and container platforms, where successful exploitation can lead to full host compromise, data exposure, and loss of isolation.
We recommend you to update Linux to version 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10, or 6.19 .[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]