Linux Kernel Zero-Day CVE-2026-23111: Public Exploit Enables Full Root Access on Debian and Ubuntu

A fully working privilege escalation exploit for CVE-2026-23111 is now publicly available, giving any unprivileged local user on an unpatched Linux system the ability to escalate to root and break out of a container. The upstream patch was issued on 5 February 2026. The exploit has been public since April. As of this week, Exodus Intelligence has published a detailed technical walkthrough, placing full root access one step closer for any attacker who already has a low-privileged foothold on a vulnerable system.

The flaw sits in nf_tables, the Linux kernel's packet-filtering code. It is classified as a use-after-free vulnerability and was introduced by a single inverted conditional check in the source. The upstream fix removed it in one line of code. Ubuntu rates the flaw CVSS 7.8 high. The reachable attack path is common across enterprise Linux environments. It requires nf_tables combined with unprivileged user namespaces, a Linux feature that ships by default on most desktop distributions and many server builds. There is no remote vector for this vulnerability on its own. It is a post-access escalation tool: an attacker uses it after gaining a foothold through a compromised service account, a phishing-delivered payload, or a low-privileged container escape to achieve full root on the host.

Exodus researcher Oliver Sieber, who discovered the flaw in early 2025, chained it into a complete local root exploit. The technique manipulates the use-after-free condition, bypasses the kernel's built-in memory protections, and seizes control of execution to grant root and escape the container namespace. The exploit has been demonstrated successfully on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. FuzzingLabs independently reproduced the vulnerability on RHEL 10 ahead of Pwn2Own Berlin 2026 via a different exploitation route.

Remediation and Operational Security for GCC Enterprises

The timeline deserves attention. The fix shipped on 5 February. FuzzingLabs published their reproduction on 16 April. Exodus published its full technical walkthrough on 8 June. The technique is now documented across Debian, Ubuntu, and Red Hat. Any distribution that shipped a vulnerable kernel with both nf_tables and unprivileged user namespaces enabled is exposed until the patch is applied. CVE-2026-23111 is part of a broader run of Linux local privilege escalation disclosures that has kept enterprise security teams occupied in recent months, including Copy Fail, Dirty Frag, Fragnesia, DirtyDecrypt, and a nine-year-old ptrace flaw. They differ in technical detail but share a common pattern that should concern security operations teams: an unprivileged foothold is consistently turning into root on ordinary installs.

For GCC enterprises running Linux-based server infrastructure, cloud workloads, or containerised application environments, the remediation steps are straightforward but time-sensitive. Update the kernel and reboot. Ubuntu fixes are available for 22.04, 24.04, and 25.10. Debian has fixed Bookworm and Trixie, with a 6.1 backport for Bullseye LTS. Red Hat, SUSE, and Amazon Linux also track this flaw. Check your distribution's security advisory for the specific kernel package version that contains the fix, as the exact version number varies by distribution. Where patching cannot be applied immediately, the most effective interim control is restricting what unprivileged users can do with user namespaces. Removing or limiting that capability closes the exploitation path until the patch is in place. There are no confirmed reports of exploitation in the wild and no threat actor has been attributed to active use of CVE-2026-23111 at this time. That status can change quickly once detailed exploitation guidance is publicly available, as it now is.