CVE-2026-23111
Detail
Modified After Enrichment
This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.
Description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
nft_map_catchall_activate() has an inverted element activity check
compared to its non-catchall counterpart nft_mapelem_activate() and
compared to what is logically required.
nft_map_catchall_activate() is called from the abort path to re-activate
catchall map elements that were deactivated during a failed transaction.
It should skip elements that are already active (they don't need
re-activation) and process elements that are inactive (they need to be
restored). Instead, the current code does the opposite: it skips inactive
elements and processes active ones.
Compare the non-catchall activate callback, which is correct:
nft_mapelem_activate():
if (nft_set_elem_active(ext, iter->genmask))
return 0; /* skip active, process inactive */
With the buggy catchall version:
nft_map_catchall_activate():
if (!nft_set_elem_active(ext, genmask))
continue; /* skip inactive, process active */
The consequence is that when a DELSET operation is aborted,
nft_setelem_data_activate() is never called for the catchall element.
For NFT_GOTO verdict elements, this means nft_data_hold() is never
called to restore the chain->use reference count. Each abort cycle
permanently decrements chain->use. Once chain->use reaches zero,
DELCHAIN succeeds and frees the chain while catchall verdict elements
still reference it, resulting in a use-after-free.
This is exploitable for local privilege escalation from an unprivileged
user via user namespaces + nftables on distributions that enable
CONFIG_USER_NS and CONFIG_NF_TABLES.
Fix by removing the negation so the check matches nft_mapelem_activate():
skip active elements, process inactive ones.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 Severity and Vector Strings:
Base
Score:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Change History
8 change records found show changes
CVE Modified by redhat-SADP
6/29/2026 11:17:30 PM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V3.1 |
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| Added |
CWE |
CWE-672
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2026:10108
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2026:10996
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2026:18134
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2026:6570
|
| Added |
Reference |
https://access.redhat.com/errata/RHSA-2026:9112
|
| Added |
Reference |
https://access.redhat.com/security/cve/CVE-2026-23111
|
| Added |
Reference |
https://bugzilla.redhat.com/show_bug.cgi?id=2439687
|
| Added |
Reference |
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23111.json
|
| Added |
Affected |
Record truncated, showing 2048 of 4439 characters.
View Entire Change Record
[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS (v. 10.0)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 10)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS (v.9.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_eus:9.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS (v.9.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 9)","defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS EUS (v. 10.0)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 10)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS EUS (v.9.4)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_eus:9.4::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS EUS (v.9.6)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_eus:9.6::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 9)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat CodeReady Linux Builder EUS (v.9.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_eus:9.4::crb"]},{"vendor":"Red Hat","product
|
CVE Modified by siemens-SADP
6/17/2026 6:20:54 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Affected |
[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"V4.0","versionType":"custom","status":"affected"}]}]
|
CVE Modified by CISA-ADP
6/17/2026 6:20:54 AM
| Action |
Type |
Old Value |
New Value |
| Added |
CWE |
CWE-416
|
| Added |
Reference |
https://blog.exodusintel.com/2026/06/08/off-by-exploiting-a-use-after-free-in-the-linux-kernel/
|
| Added |
SSVC |
{"timestamp":"2026-06-09T13:07:47.429787Z","id":"CVE-2026-23111","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}
|
CVE Modified by kernel.org
6/17/2026 6:20:54 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Affected |
Record truncated, showing 2048 of 2869 characters.
View Entire Change Record
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_tables_api.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8","lessThan":"8c760ba4e36c750379d13569f23f5a6e185333f5","versionType":"git","status":"affected"},{"version":"d60be2da67d172aecf866302c91ea11533eca4d9","lessThan":"b9b6573421de51829f7ec1cce76d85f5f6fbbd7f","versionType":"git","status":"affected"},{"version":"628bd3e49cba1c066228e23d71a852c23e26da73","lessThan":"42c574c1504aa089a0a142e4c13859327570473d","versionType":"git","status":"affected"},{"version":"628bd3e49cba1c066228e23d71a852c23e26da73","lessThan":"1444ff890b4653add12f734ffeffc173d42862dd","versionType":"git","status":"affected"},{"version":"628bd3e49cba1c066228e23d71a852c23e26da73","lessThan":"8b68a45f9722f2babe9e7bad00aa74638addf081","versionType":"git","status":"affected"},{"version":"628bd3e49cba1c066228e23d71a852c23e26da73","lessThan":"f41c5d151078c5348271ffaf8e7410d96f2d82f8","versionType":"git","status":"affected"},{"version":"bc9f791d2593f17e39f87c6e2b3a36549a3705b1","versionType":"git","status":"affected"},{"version":"3c7ec098e3b588434a8b07ea9b5b36f04cef1f50","versionType":"git","status":"affected"},{"version":"a136b7942ad2a50de708f76ea299ccb45ac7a7f9","versionType":"git","status":"affected"},{"version":"dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41","versionType":"git","status":"affected"},{"version":"5.15.121","lessThan":"5.15.200","versionType":"semver","status":"affected"},{"version":"6.1.36","lessThan":"6.1.163","versionType":"semver","status":"affected"},{"version":"4.19.316","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.262","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.10.188","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"6.3.10","lessThan":"6.4","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","pro
|
CVE Modified by siemens-SADP
6/02/2026 10:16:47 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
|
CVE Modified by kernel.org
4/03/2026 10:16:23 AM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V3.1 |
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
Initial Analysis by NIST
3/18/2026 9:43:28 AM
| Action |
Type |
Old Value |
New Value |
| Added |
CVSS V3.1 |
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| Added |
CWE |
CWE-416
|
| Added |
CPE Configuration |
OR
*cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.262 up to (excluding) 5.5
*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.188 up to (excluding) 5.11
*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19.316 up to (excluding) 4.20
*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.3.10 up to (excluding) 6.4
*cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.70
*cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.121 up to (excluding) 5.15.200
*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.36 up to (excluding) 6.1.163
*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.10
*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.4.1 up to (excluding) 6.6.124
*cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
*cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*
|
| Added |
Reference Type |
kernel.org: https://git.kernel.org/stable/c/1444ff890b4653add12f734ffeffc173d42862dd Types: Patch
|
| Added |
Reference Type |
kernel.org: https://git.kernel.org/stable/c/42c574c1504aa089a0a142e4c13859327570473d Types: Patch
|
| Added |
Reference Type |
kernel.org: https://git.kernel.org/stable/c/8b68a45f9722f2babe9e7bad00aa74638addf081 Types: Patch
|
| Added |
Reference Type |
kernel.org: https://git.kernel.org/stable/c/8c760ba4e36c750379d13569f23f5a6e185333f5 Types: Patch
|
| Added |
Reference Type |
kernel.org: https://git.kernel.org/stable/c/b9b6573421de51829f7ec1cce76d85f5f6fbbd7f Types: Patch
|
| Added |
Reference Type |
kernel.org: https://git.kernel.org/stable/c/f41c5d151078c5348271ffaf8e7410d96f2d82f8 Types: Patch
|
New CVE Received from kernel.org
2/13/2026 9:16:10 AM
| Action |
Type |
Old Value |
New Value |
| Added |
Description |
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
nft_map_catchall_activate() has an inverted element activity check
compared to its non-catchall counterpart nft_mapelem_activate() and
compared to what is logically required.
nft_map_catchall_activate() is called from the abort path to re-activate
catchall map elements that were deactivated during a failed transaction.
It should skip elements that are already active (they don't need
re-activation) and process elements that are inactive (they need to be
restored). Instead, the current code does the opposite: it skips inactive
elements and processes active ones.
Compare the non-catchall activate callback, which is correct:
nft_mapelem_activate():
if (nft_set_elem_active(ext, iter->genmask))
return 0; /* skip active, process inactive */
With the buggy catchall version:
nft_map_catchall_activate():
if (!nft_set_elem_active(ext, genmask))
continue; /* skip inactive, process active */
The consequence is that when a DELSET operation is aborted,
nft_setelem_data_activate() is never called for the catchall element.
For NFT_GOTO verdict elements, this means nft_data_hold() is never
called to restore the chain->use reference count. Each abort cycle
permanently decrements chain->use. Once chain->use reaches zero,
DELCHAIN succeeds and frees the chain while catchall verdict elements
still reference it, resulting in a use-after-free.
This is exploitable for local privilege escalation from an unprivileged
user via user namespaces + nftables on distributions that enable
CONFIG_USER_NS and CONFIG_NF_TABLES.
Fix by removing the negation so the check matches nft_mapelem_activate():
skip active elements, process inactive ones.
|
| Added |
Reference |
https://git.kernel.org/stable/c/1444ff890b4653add12f734ffeffc173d42862dd
|
| Added |
Reference |
https://git.kernel.org/stable/c/42c574c1504aa089a0a142e4c13859327570473d
|
| Added |
Reference |
https://git.kernel.org/stable/c/8b68a45f9722f2babe9e7bad00aa74638addf081
|
| Added |
Reference |
https://git.kernel.org/stable/c/8c760ba4e36c750379d13569f23f5a6e185333f5
|
| Added |
Reference |
https://git.kernel.org/stable/c/b9b6573421de51829f7ec1cce76d85f5f6fbbd7f
|
| Added |
Reference |
https://git.kernel.org/stable/c/f41c5d151078c5348271ffaf8e7410d96f2d82f8
|
Quick Info
CVE Dictionary Entry: CVE-2026-23111 NVD
Published Date: 02/13/2026 NVD
Last Modified: 06/29/2026
Source: kernel.org
|
