Single character error causes high-severity Linux vulnerability
Original: High-severity vulnerability in Linux caused by a single errant character
Why This Matters
Highlights how minor coding errors can create severe security risks in critical infrastructure
CVE-2026-23111 in Linux nf_tables subsystem caused by misplaced exclamation point allows unprivileged users to escalate to root privileges. Fixed in February, affects packet filtering in firewall rules.
A high-severity Linux vulnerability tracked as CVE-2026-23111 stems from a single errant exclamation point in the nf_tables kernel subsystem. The character error creates a use-after-free bug that allows unprivileged users to gain root access. The flaw affects nf_tables, which manages firewall rules and replaces older systems like iptables. The vulnerability disrupts deletion of verdicts and catchall elements, allowing attackers to manipulate reference counters and free memory while objects still point to it. Security firm Exodus Intelligence reports exploit stability exceeding 99% on idle systems. The bug was patched in February and backported to major distributions. FuzzingLabs demonstrated a proof-of-concept in April.