Back Blog.Exodusintel

Off By !: Exploiting a Use-after

Blog.Exodusintel •Exodus Intel VRT • June 8, 2026

By Oliver Sieber Overview In this blog post, we a use-after-free vulnerability that we found in the nftables subsystem of the Linux kernel in early 2025. This vulnerability was patched upstream on 5 February 2026 and assigned CVE-2026-23111. This blog post covers a technical analysis of the vulnerability and how we exploited it to perform a local ... Off By !: Exploiting a Use-after-Free in the Linux Kernel

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Linux Kernel CVE-2026-23111 Enables Local Privilege Escalation via nftables A use-after-free vulnerability in the Linux kernel's nftables subsystem, tracked as CVE-2026-23111, allows local attackers to escalate privileges to root. Discovered in early 2025, the flaw was patched on February 5, 2026. It affects widely used distributions including Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. The vulnerability is exploited by leveraging a logic error in the code, which has been demonstrated in a proof of concept released on June 9, 2026. Security researchers from Exodus Intelligence conducted a detailed analysis and exploitation of this vulnerability. The flaw poses a significant risk to systems running affected Linux distributions, especially in environments where local access is possible. 4 sources 74

Extracted Entities

Off By !: Exploiting a Use-after

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)