CVE-2026-23111

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the nf tables component of the Linux kernel. The function nft map catchall activate() contains a logic bug where an inverted element activity check is performed during the abort path of a failed transaction. Specifically, the function incorrectly skips inactive elements and processes active ones, which is the opposite of the required behavior seen in nft mapelem activate().

When a DELSET operation is aborted, nft setelem data activate() is not called for the catchall element. For NFT GOTO verdict elements, this prevents nft data hold() from restoring the chain->use reference count. Repeated abort cycles permanently decrement chain->use until it reaches zero, allowing a DELCHAIN operation to free the chain while catchall verdict elements still reference it. A local low-privileged user can exploit this via user namespaces and nftables on distributions where CONFIG USER NS and CONFIG NF TABLES are enabled to cause a denial of service, achieve local privilege escalation to root, or escape containers.

Recommendations Update the Linux kernel to the version containing the fix applied on February 5, 2026. As a temporary mitigation, restrict the ability of unprivileged users to create network namespaces by setting kernel.unprivileged userns clone=0.