CVE-2026-23111 Auditor (Linux Kernel nf_tables UAF)

This repository contains an automated audit script in Bash designed to deeply and accurately evaluate the CVE-2026-23111 vulnerability in Linux environments.

---

🔍 What is the CVE-2026-23111 vulnerability?

CVE-2026-23111 is a Use-After-Free (UAF) vulnerability discovered in the nf_tables subsystem of the Linux kernel (generally affecting development and stable versions prior to the 6.13 branch).

The flaw lies in incorrect memory management within the activation logic of captured elements (nft_map_catchall_activate). A local attacker with few privileges can exploit this flaw to achieve Local Privilege Escalation (LPE) to root.

Vectors and Requirements for Exploitation:

For an exploit to succeed on a system, three factors usually must coexist simultaneously:

1. Affected kernel: A kernel that includes the unpatched bug.
2. Active User Namespaces: Allows unprivileged users to clone a namespace (CAP_NET_ADMIN) to directly interact with nf_tables.
3. Enabled module: The nf_tables module must be loaded or available for auto-loading by the operating system.

---

🛠️ Advanced Script Features

This Bash script performs a detailed audit by analyzing four critical layers:

• Environment Identification: Extracts the exact kernel version and distribution.
• Namespace Mitigation Analysis: Inspects the sysctl parameters (unprivileged_userns_clone or max_user_namespaces) to verify if the common exploit's entry vector is blocked.
• Network Module Status: Detects if nf_tables is loaded or if there is a blacklist rule in the modprobe.d configuration files.
• Compilation Inspection (CONFIG_X): Searches and reads the operating kernel's compilation flags (via /proc/config.gz or /boot/config-*) to verify the presence of CONFIG_USER_NS and CONFIG_NF_TABLES.

---

Execution: bash CVE-2026-23111-checker.sh