High-severity vulnerability in Linux caused by a single faulty character - Ars Technica
Skip to content
AI
Biz & IT
Cars
Culture
Gaming
Health
Policy
Science
Security
Space
Tech
Forum
Subscribe
Story text
Size
Small<br>Standard<br>Large
Width
Standard<br>Wide
Links
Standard<br>Orange
* Subscribers only
Learn more
Pin to story
Theme
Search
Sign In
Sign in dialog...
Text<br>settings
Story text
Size
Small<br>Standard<br>Large
Width
Standard<br>Wide
Links
Standard<br>Orange
* Subscribers only
Learn more
Minimize to nav
Researchers have analyzed a high-severity vulnerability in Linux that’s able to escalate untrusted users to root by exploiting a bug you don’t often see: a single errant character inside the kernel.
The vulnerability, tracked as CVE-2026-23111, is located in nf_tables, a subsystem of the Linux kernel that provides packet filtering capabilities. It’s used to manage firewall rules and replaces older subsystems such as iptables, ip6tables, arptables, and ebtables.
!!!WTF!!!
The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts memory by placing malicious code at memory addresses that haven’t been properly freed of their previous contents. CVE-2026-23111 can be exploited by an unprivileged user or process to elevate system rights to root.
The exploit works by disrupting the deletion of verdicts—a determination within the nf_tables framework that determines if a packet matches a rule calling for a certain action to be performed. This process can use what are known as catchall elements, which act as a wildcard in the event a lookup doesn’t match any other element in the set.
When a verdict map is deleted from memory, catchall elements are deactivated and a chain’s reference counter is decremented. When errors occur the deletion can be reversed and the counter incremented. CVE-2026-53111 allows for that process to be altered. As a result, the exploit can decrement the variable an arbitrary number of times and then delete and free the chain when some objects still point to it.
“In this blog post, we have seen how one incorrect exclamation mark introduced a use-after-free vulnerability which can be exploited by an unprivileged user on Debian and Ubuntu to escalate privileges to root,” researchers from security firm Exodus Intelligence wrote Monday. “Although the exploit triggers the use-after-free vulnerability multiple times to leak the kernel base address, leak heap addresses, and hijack the control flow, the stability tests resulted in a stability of >99% on an idle system.”
The vulnerability was fixed in the kernel in February and subsequently back ported to major Linux distributions. Security firm FuzzingLabs demonstrated a proof of concept exploit in April. Exodus Intelligence, which discovered the bug, included its own PoC exploit in Monday’s post. It worked on Debian and Ubuntu.
CVE-2026-53111 is one of at least three potent elevation-of-privilege vulnerabilities to hit Linux in recent weeks. The vulnerabilities are serious, because, when chained to a separate exploit, they can be used to evade security defenses baked into the OS.
Dan Goodin
Senior Security Editor
Dan Goodin
Senior Security Editor
Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82.
47 Comments
Staff Picks
Both this article and the CVE article it links to are pretty damn poor in terms of description and severity and threat model. It's a big one for sure, but only if you allow untrusted users into your systems. So public access linux systems and schools and maybe even SSH bastion hosts might be hugely impacted.<br>In real exploits, it's pretty common to pair an unprivileged remote exploit with a local privilege escalation exploit. Remote exploits that give you full privileges on a system are much less common than either of the former types of exploits.
This in general is how systems are infiltrated. You find access and then look for a way to use that access level to expand your access to systems.
June 9, 2026 at 3:48 pm
Comments
Forum view
Loading comments...
Prev story
Next story
1.<br>First Drive: The 2027 Rivian R2 entirely changes the EV game
2.<br>Starlink charges $10 monthly hardware fee in move away from one-time purchases
3.<br>Tests suggest Russian satellites can jam GPS on a continental scale
4.<br>For the 2nd time in weeks, Microsoft packages laced with credential stealer
5.<br>High-severity vulnerability in Linux caused by a single faulty character
Customize