{
  "threat_severity" : "Moderate",
  "public_date" : "2026-02-13T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check",
    "id" : "2439687",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2439687"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-672",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()\nnft_map_catchall_activate() has an inverted element activity check\ncompared to its non-catchall counterpart nft_mapelem_activate() and\ncompared to what is logically required.\nnft_map_catchall_activate() is called from the abort path to re-activate\ncatchall map elements that were deactivated during a failed transaction.\nIt should skip elements that are already active (they don't need\nre-activation) and process elements that are inactive (they need to be\nrestored). Instead, the current code does the opposite: it skips inactive\nelements and processes active ones.\nCompare the non-catchall activate callback, which is correct:\nnft_mapelem_activate():\nif (nft_set_elem_active(ext, iter->genmask))\nreturn 0;   /* skip active, process inactive */\nWith the buggy catchall version:\nnft_map_catchall_activate():\nif (!nft_set_elem_active(ext, genmask))\ncontinue;   /* skip inactive, process active */\nThe consequence is that when a DELSET operation is aborted,\nnft_setelem_data_activate() is never called for the catchall element.\nFor NFT_GOTO verdict elements, this means nft_data_hold() is never\ncalled to restore the chain->use reference count. Each abort cycle\npermanently decrements chain->use. Once chain->use reaches zero,\nDELCHAIN succeeds and frees the chain while catchall verdict elements\nstill reference it, resulting in a use-after-free.\nThis is exploitable for local privilege escalation from an unprivileged\nuser via user namespaces + nftables on distributions that enable\nCONFIG_USER_NS and CONFIG_NF_TABLES.\nFix by removing the negation so the check matches nft_mapelem_activate():\nskip active elements, process inactive ones.", "A flaw was found in the Linux kernel's nf_tables component. A logic bug in nft_map_catchall_activate causes an inverted element activity check during the abort path of a failed transaction. This can lead to a use-after-free vulnerability, as catchall verdict elements may still reference a freed chain. A local low privileged user can exploit this to cause a denial of service or potentially achieve privilege escalation." ],
  "statement" : "A logic bug in nf_tables nft_map_catchall_activate uses an inverted element active check during the abort path of a failed transaction. This can prevent re activation of catchall map elements and for NFT_GOTO verdict elements it can skip restoring the chain use reference count. Repeating an abort sequence can permanently decrement chain use until DELCHAIN frees the chain while catchall elements still reference it which can result in a use after free. For the CVSS the PR is L, but in the paranoid scenario the unprivileged users may reach nf_tables via user namespaces with delegated CAP_NET_ADMIN. The issue is not directly network reachable and is triggered by local nftables control plane operations. Impact can range from denial of service to potential privilege escalation depending on heap reuse.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-04-06T00:00:00Z",
    "advisory" : "RHSA-2026:6570",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-611.47.1.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-04-06T00:00:00Z",
    "advisory" : "RHSA-2026:6570",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-611.47.1.el9_7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-23111\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23111\nhttps://lore.kernel.org/linux-cve-announce/2026021300-CVE-2026-23111-9762@gregkh/T" ],
  "name" : "CVE-2026-23111",
  "mitigation" : {
    "value" : "To mitigate this issue, prevent module nf_tables from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.",
    "lang" : "en:us"
  },
  "csaw" : false
}