Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-23111

37
FAUCET Score

CVE-2026-23111 is a use-after-free vulnerability in the Linux kernel's netfilter nftables component, specifically within the nft_map_catchall_activate() function. This flaw arises from an inverted logic check during the re-activation of catchall map elements after a failed transaction, leading to a permanent decrement of a chain's reference count. This can be exploited for local privilege escalation by an unprivileged user on systems with user namespaces and nftables enabled. While no CVSS score is provided, its EPSS score is low, and its FAUCET Risk Score is 27/100, indicating a moderate risk. There is no evidence of active exploitation, public exploit code, or Metasploit/Nuclei modules, though it has garnered minimal community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
>= 4.19.316, < 4.20CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 5.4.262, < 5.5CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 5.10.188, < 5.11CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 5.15.121, < 5.15.200CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 6.1.36, < 6.1.163CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.8HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.48%
Probability of exploitation in next 30 days
EPSS Percentile
38.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0048 is in the 79th percentile among its peer group of 17,061 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (118)

ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (noble)Fixed in: 6.8.0-1049.50
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra (noble)Fixed in: 6.8.0-1021.21
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-5.15 (focal)Fixed in: 5.15.0-176.186~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-6.8 (jammy)Fixed in: 6.8.0-1049.50~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-5.15 (focal)Fixed in: 5.15.0-1110.119~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-xilinx (noble)Fixed in: 6.8.0-1029.30
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime-6.8 (jammy)Fixed in: 6.8.1-1046.47~22.04.2
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi-realtime (noble)Fixed in: 6.8.0-2041.42
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (noble)Fixed in: 6.8.1-1046.47
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-fips (noble)Fixed in: 6.8.0-1051.54+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-fips (noble)Fixed in: 6.8.0-107.107+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-fips (noble)Fixed in: 6.8.0-1053.56+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-6.17 (noble)Fixed in: 6.17.0-1010.10~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-6.17 (noble)Fixed in: 6.17.0-1010.10~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-6.17 (noble)Fixed in: 6.17.0-20.20~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux (questing)Fixed in: 6.17.0-20.20
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (questing)Fixed in: 6.17.0-1010.10
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (questing)Fixed in: 6.17.0-1010.10
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (questing)Fixed in: 6.17.0-1009.10
ubuntupatch availablevia ubuntu_usn
Product: linux (noble)Fixed in: 6.8.0-107.107
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (noble)Fixed in: 6.8.0-1051.54
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (noble)Fixed in: 6.8.0-1053.56
ubuntupatch availablevia ubuntu_usn
Product: linux-gke (noble)Fixed in: 6.8.0-1049.54
ubuntupatch availablevia ubuntu_usn
Product: linux-gkeop (noble)Fixed in: 6.8.0-1036.39
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm (noble)Fixed in: 6.8.0-1050.50
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency (noble)Fixed in: 6.8.0-107.107.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia (noble)Fixed in: 6.8.0-1050.53
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (noble)Fixed in: 6.8.0-1051.55
ubuntupatch availablevia ubuntu_usn
Product: linux-oem-6.17 (noble)Fixed in: 6.17.0-1017.17
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime-6.17 (noble)Fixed in: 6.17.0-1009.10~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-5.15 (focal)Fixed in: 5.15.0-1104.111~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-6.17 (noble)Fixed in: 6.17.0-1010.10~24.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (questing)Fixed in: 6.17.0-1010.10
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (questing)Fixed in: 6.17.0-1011.11
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-6.8 (jammy)Fixed in: 6.8.0-1051.54~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-6.8 (jammy)Fixed in: 6.8.0-1053.56~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-hwe-6.8 (jammy)Fixed in: 6.8.0-107.107~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm-6.8 (jammy)Fixed in: 6.8.0-1050.50~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency-hwe-6.8 (jammy)Fixed in: 6.8.0-107.107.1~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-6.8 (jammy)Fixed in: 6.8.0-1050.53~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-realtime (jammy)Fixed in: 5.15.0-1103.112
ubuntupatch availablevia ubuntu_usn
Product: linux-aws-fips (jammy)Fixed in: 5.15.0-1104.111+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-fips (jammy)Fixed in: 5.15.0-174.184+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-fips (jammy)Fixed in: 5.15.0-1104.113+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp-5.15 (focal)Fixed in: 5.15.0-1104.113~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm-5.15 (focal)Fixed in: 5.15.0-1098.101~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iotg-5.15 (focal)Fixed in: 5.15.0-1099.105~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency-hwe-5.15 (focal)Fixed in: 5.15.0-174.184~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle-5.15 (focal)Fixed in: 5.15.0-1101.107~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux (jammy)Fixed in: 5.15.0-174.184
ubuntupatch availablevia ubuntu_usn
Product: linux-aws (jammy)Fixed in: 5.15.0-1104.111
ubuntupatch availablevia ubuntu_usn
Product: linux-gcp (jammy)Fixed in: 5.15.0-1104.113
ubuntupatch availablevia ubuntu_usn
Product: linux-gke (jammy)Fixed in: 5.15.0-1100.106
ubuntupatch availablevia ubuntu_usn
Product: linux-gkeop (jammy)Fixed in: 5.15.0-1087.95
ubuntupatch availablevia ubuntu_usn
Product: linux-ibm (jammy)Fixed in: 5.15.0-1098.101
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iotg (jammy)Fixed in: 5.15.0-1099.105
ubuntupatch availablevia ubuntu_usn
Product: linux-kvm (jammy)Fixed in: 5.15.0-1096.101
ubuntupatch availablevia ubuntu_usn
Product: linux-lowlatency (jammy)Fixed in: 5.15.0-174.184
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia (jammy)Fixed in: 5.15.0-1099.100
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra (jammy)Fixed in: 5.15.0-1056.56
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra-igx (jammy)Fixed in: 5.15.0-1045.45
ubuntupatch availablevia ubuntu_usn
Product: linux-oracle (jammy)Fixed in: 5.15.0-1101.107
ubuntupatch availablevia ubuntu_usn
Product: linux-raspi (jammy)Fixed in: 5.15.0-1098.101
ubuntupatch availablevia ubuntu_usn
Product: linux-xilinx-zynqmp (jammy)Fixed in: 5.15.0-1068.72
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-fips (noble)Fixed in: 6.8.0-1052.58+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-intel-iot-realtime (jammy)Fixed in: 5.15.0-1096.98
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-fips (jammy)Fixed in: 5.15.0-1109.118+fips1
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-tegra-5.15 (focal)Fixed in: 5.15.0-1057.57~20.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-6.8 (jammy)Fixed in: 6.8.0-1052.58~22.04.1
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (noble)Fixed in: 6.8.0-1052.58
ubuntupatch availablevia ubuntu_usn
Product: linux-azure-6.17 (noble)Fixed in: 6.17.0-1011.11~24.04.2
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (questing)Fixed in: 6.17.0-1011.11
ubuntupatch availablevia ubuntu_usn
Product: linux-azure (jammy)Fixed in: 5.15.0-1109.118
ubuntupatch availablevia ubuntu_usn
Product: aws (bionic)Fixed in: 4.15.0-1159
ubuntupatch availablevia ubuntu_usn
Product: azure-4.15 (bionic)Fixed in: 4.15.0-1168
ubuntupatch availablevia ubuntu_usn
Product: gcp-4.15 (bionic)Fixed in: 4.15.0-1154
ubuntupatch availablevia ubuntu_usn
Product: generic-4.15 (bionic)Fixed in: 4.15.0-214
ubuntupatch availablevia ubuntu_usn
Product: lowlatency-4.15 (bionic)Fixed in: 4.15.0-214
ubuntupatch availablevia ubuntu_usn
Product: generic-5.4 (bionic)Fixed in: 5.4.0-150
ubuntupatch availablevia ubuntu_usn
Product: lowlatency-5.4 (bionic)Fixed in: 5.4.0-150
ubuntupatch availablevia ubuntu_usn
Product: oracle (bionic)Fixed in: 4.15.0-1129
ubuntupatch availablevia ubuntu_usn
Product: aws-5.15 (focal)Fixed in: 5.15.0-1000
ubuntupatch availablevia ubuntu_usn
Product: aws (focal)Fixed in: 5.4.0-1009
ubuntupatch availablevia ubuntu_usn
Product: aws (focal)Fixed in: 5.4.0-1061
ubuntupatch availablevia ubuntu_usn
Product: azure-5.15 (focal)Fixed in: 5.15.0-1069
ubuntupatch availablevia ubuntu_usn
Product: gcp-5.15 (focal)Fixed in: 5.15.0-1000
ubuntupatch availablevia ubuntu_usn
Product: generic-5.15 (focal)Fixed in: 5.15.0-0
ubuntupatch availablevia ubuntu_usn
Product: lowlatency-5.15 (focal)Fixed in: 5.15.0-0
ubuntupatch availablevia ubuntu_usn
Product: generic-5.4 (focal)Fixed in: 5.4.0-26
ubuntupatch availablevia ubuntu_usn
Product: lowlatency-5.4 (focal)Fixed in: 5.4.0-26
ubuntupatch availablevia ubuntu_usn
Product: ibm-5.15 (focal)Fixed in: 5.15.0-1000
ubuntupatch availablevia ubuntu_usn
Product: oracle-5.15 (focal)Fixed in: 5.15.0-1055
ubuntupatch availablevia ubuntu_usn
Product: aws (jammy)Fixed in: 5.15.0-1000
ubuntupatch availablevia ubuntu_usn
Product: aws-6.8 (jammy)Fixed in: 6.8.0-1000
ubuntupatch availablevia ubuntu_usn
Product: azure (jammy)Fixed in: 5.15.0-1000
ubuntupatch availablevia ubuntu_usn
Product: gcp (jammy)Fixed in: 5.15.0-1000
ubuntupatch availablevia ubuntu_usn
Product: gcp-6.8 (jammy)Fixed in: 6.8.0-1000
ubuntupatch availablevia ubuntu_usn
Product: linux (jammy)Fixed in: 5.15.0-71
ubuntupatch availablevia ubuntu_usn
Product: linux (jammy)Fixed in: 5.15.0-24
ubuntupatch availablevia ubuntu_usn
Product: gke (jammy)Fixed in: 5.15.0-1000
ubuntupatch availablevia ubuntu_usn
Product: ibm (jammy)Fixed in: 5.15.0-1000
ubuntupatch availablevia ubuntu_usn
Product: ibm-6.8 (jammy)Fixed in: 6.8.0-1000
ubuntupatch availablevia ubuntu_usn
Product: oracle (jammy)Fixed in: 5.15.0-1055
ubuntupatch availablevia ubuntu_usn
Product: aws (noble)Fixed in: 6.8.0-1008
ubuntupatch availablevia ubuntu_usn
Product: azure (noble)Fixed in: 6.8.0-1007
ubuntupatch availablevia ubuntu_usn
Product: gcp (noble)Fixed in: 6.8.0-1007
ubuntupatch availablevia ubuntu_usn
Product: linux (noble)Fixed in: 6.8.0-1
ubuntupatch availablevia ubuntu_usn
Product: ibm (noble)Fixed in: 6.8.0-1005
ubuntupatch availablevia ubuntu_usn
Product: oracle (noble)Fixed in: 6.8.0-1005
ubuntupatch availablevia ubuntu_usn
Product: linux (questing)Fixed in: 6.17.0-1
ubuntupatch availablevia ubuntu_usn
Product: aws-hwe (xenial)Fixed in: 4.15.0-1126
ubuntupatch availablevia ubuntu_usn
Product: azure (xenial)Fixed in: 4.15.0-1114
ubuntupatch availablevia ubuntu_usn
Product: generic-4.15 (xenial)Fixed in: 4.15.0-143
ubuntupatch availablevia ubuntu_usn
Product: lowlatency-4.15 (xenial)Fixed in: 4.15.0-143
ubuntupatch availablevia ubuntu_usn
Product: linux-nvidia-lowlatency (noble)Fixed in: 6.8.0-1050.53.1
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: kernel-rt
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: kernel

Vendor Advisories (25)

ubuntuUSN-8261-1

Linux kernel (Xilinx) vulnerabilities

May 7, 2026
ubuntuUSN-8243-1

Linux kernel (Azure) vulnerabilities

May 7, 2026
ubuntuUSN-8203-1

Linux kernel (Oracle) vulnerabilities

Apr 23, 2026
ubuntuUSN-8188-1

Linux kernel (HWE) vulnerabilities

Apr 17, 2026
ubuntuUSN-8148-7

Linux kernel (NVIDIA) vulnerabilities

Apr 16, 2026
ubuntuUSN-8148-6

Linux kernel (Azure) vulnerabilities

Apr 14, 2026
ubuntuUSN-8149-3

Linux kernel (Azure) vulnerabilities

Apr 14, 2026
ubuntuUSN-8163-2

Linux kernel (Azure) vulnerabilities

Apr 13, 2026
ubuntuLSN-0119-1

Kernel Live Patch Security Notice

Apr 13, 2026
ubuntuUSN-8165-1

Linux kernel (Azure FIPS) vulnerabilities

Apr 9, 2026
ubuntuUSN-8164-1

Linux kernel (Intel IoTG Real-time) vulnerabilities

Apr 9, 2026
ubuntuUSN-8163-1

Linux kernel (Azure FIPS) vulnerabilities

Apr 9, 2026
ubuntuUSN-8162-1

Linux kernel (NVIDIA Tegra) vulnerabilities

Apr 9, 2026
ubuntuUSN-8149-2

Linux kernel vulnerabilities

Apr 9, 2026
ubuntuUSN-8148-5

Linux kernel vulnerabilities

Apr 9, 2026
ubuntuUSN-8159-3

Linux kernel (Real-time) vulnerabilities

Apr 8, 2026
ubuntuUSN-8159-2

Linux kernel (FIPS) vulnerabilities

Apr 8, 2026
ubuntuUSN-8159-1

Linux kernel vulnerabilities

Apr 8, 2026
ubuntuUSN-8152-1

Linux kernel (OEM) vulnerabilities

Apr 6, 2026
ubuntuUSN-8148-4

Linux kernel (Real-time) vulnerabilities

Apr 6, 2026
ubuntuUSN-8148-3

Linux kernel (Real-time) vulnerabilities

Apr 2, 2026
ubuntuUSN-8148-2

Linux kernel (FIPS) vulnerabilities

Apr 2, 2026
ubuntuUSN-8149-1

Linux kernel vulnerabilities

Apr 2, 2026
ubuntuUSN-8148-1

Linux kernel vulnerabilities

Apr 2, 2026
redhatCVE-2026-23111Moderate

kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check

Feb 13, 2026

References

access.redhat.com / errata/RHSA-2026:10108
access.redhat.com / errata/RHSA-2026:10996
access.redhat.com / errata/RHSA-2026:18134
access.redhat.com / errata/RHSA-2026:6570
access.redhat.com / errata/RHSA-2026:9112
access.redhat.com / security/cve/CVE-2026-23111
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-23111.json
cert-portal.siemens.com / productcert/html/ssa-019113.html
cert-portal.siemens.com / productcert/html/ssa-082556.html
cert-portal.siemens.com / productcert/html/ssa-253495.html
blog.exodusintel.com / 2026/06/08/off-by-exploiting-a-use-after-free-in-the-linux-kernel
git.kernel.org / stable/c/1444ff890b4653add12f734ffeffc173d42862dd
Patch
git.kernel.org / stable/c/42c574c1504aa089a0a142e4c13859327570473d
Patch
git.kernel.org / stable/c/8b68a45f9722f2babe9e7bad00aa74638addf081
Patch
git.kernel.org / stable/c/8c760ba4e36c750379d13569f23f5a6e185333f5
Patch
git.kernel.org / stable/c/b9b6573421de51829f7ec1cce76d85f5f6fbbd7f
Patch
git.kernel.org / stable/c/f41c5d151078c5348271ffaf8e7410d96f2d82f8
Patch