CVE-2026-23111 — Linux Kernel nf_tables UAF → LPE

A working local-privilege-escalation exploit for CVE-2026-23111, a use-after-free in the Linux kernel nf_tables subsystem. Tested on linux-6.12.69 (x86-64).

Target requirements

The exploit assumes a target kernel built with:

Offsets in offsets.h are specific to one kernel build — regenerate them for any other kernel

Repository layout

Build

Requires musl-gcc (sudo apt install musl-tools).

make          # builds exp + rootme (static ELFs)
make clean    # remove built binaries

Both binaries are static so they run inside a minimal busybox initramfs with no shared libs. exp expects rootme next to it at /cve-2026-23111-poc/ on the target.

Porting to another kernel

offsets.h is generated from a specific build. For a different vmlinux:

make offsets SYSTEM_MAP=/path/to/System.map

gen_offsets.sh extracts symbols (single_start, modprobe_path, init_ipc_ns, msleep, memcpy, …) and ROP gadgets, all as offsets from the kernel base. You will also need to re-verify the struct offsets baked into exp.c (nft_chain layout, nft_expr_ops.validate, init_ipc_ns + 0x110, msg_queue.q_messages, xa_node.slots) with pahole / disassembly if your kernel differs meaningfully from 6.12.x.

Disclaimer

This code is published for defensive security research and education. It targets a lab VM running a known-vulnerable kernel. Do not use it against systems you do not own or are not authorized to test. The author assumes no liability for misuse.