This is part two of a series (https://medium.com/@miggo-engineering/detecting-the-nftables-catchall-use-after-free-cve-2026-23111-by-thinking-outside-the-box-2227654d5acf). Part one was about detecting CopyFail and DirtyFrag (https://medium.com/@miggo-engineering/detecting-copyfail-dirtyfrag-by-thinking-outside-the-box-3cae021ca94c) - if you missed it, same idea applies here. CVE-2026-23111 is a use-after-free in nf_tables, reachable from an unprivileged user namespace. The bug is a single inverted character introduced by the commit that fixed CVE-2023-4244 - a security patch that quietly planted a new reference-counting flaw and rode the backport train into every stable LTS branch for two years. The full exploit is published at: rafaeldtinoco/security -> exploits/nft-catchall-uaf (https://github.com/rafaeldtinoco/security/tree/main/exploits/nft-catchall-uaf) KASLR leak, arbitrary read, runtime kernel structure traversal, and a ROP chain that lands you at uid=0 with nothing hardcoded. The repository also covers prior work from Exodus Intelligence and FuzzingLabs and what this build adds on top of it. The Medium post is about something different: why detecting the payload is the wrong problem to solve, and what you watch instead to catch this reliably - on vulnerable and patched kernels alike, including the failed attempts that most tools never see.
Post summary
The text announces CVE-2026-23111, provides a functional exploit on GitHub with detailed technical steps, but does not indicate ongoing active exploitation or a patch.