CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

Q: What is the severity of CVE-2026-23111?

CVE-2026-23111 is a vulnerability that may impact system integrity due to the inverted genmask check in the Linux kernel.

Q: How do I fix CVE-2026-23111?

To fix CVE-2026-23111, update the Linux kernel to the latest stable version that addresses this vulnerability.

Q: What systems are affected by CVE-2026-23111?

CVE-2026-23111 affects the Linux kernel, specifically systems utilizing the netfilter functionality.

Q: What are the potential consequences of CVE-2026-23111?

The potential consequences of CVE-2026-23111 include misconfigured packet processing rules, which could lead to unauthorized access.

Q: Is there a workaround for CVE-2026-23111 if I cannot update immediately?

There are no specific workarounds for CVE-2026-23111, so it is recommended to apply the kernel update as soon as possible.

Published Feb 13, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftables: fix inverted genmask check in nftmapcatchallactivate()

nftmapcatchallactivate() has an inverted element activity check compared to its non-catchall counterpart nftmapelemactivate() and compared to what is logically required.

nftmapcatchallactivate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones.

Compare the non-catchall activate callback, which is correct:

nftmapelemactivate(): if (nftsetelemactive(ext, iter->genmask)) return 0; / skip active, process inactive /

With the buggy catchall version:

nftmapcatchallactivate(): if (!nftsetelemactive(ext, genmask)) continue; / skip inactive, process active /

The consequence is that when a DELSET operation is aborted, nftsetelemdataactivate() is never called for the catchall element. For NFTGOTO verdict elements, this means nftdatahold() is never called to restore the chain->use reference count. Each abort cycle permanently decrements chain->use. Once chain->use reaches zero, DELCHAIN succeeds and frees the chain while catchall verdict elements still reference it, resulting in a use-after-free.

This is exploitable for local privilege escalation from an unprivileged user via user namespaces + nftables on distributions that enable CONFIGUSERNS and CONFIGNFTABLES.

Fix by removing the negation so the check matches nftmapelemactivate(): skip active elements, process inactive ones.

Affected Software

207 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=4.19.316<4.20

Linux Linux kernel>=5.4.262<5.5

Linux Linux kernel>=5.10.188<5.11

Linux Linux kernel>=5.15.121<5.15.200

Linux Linux kernel>=6.1.36<6.1.163

Linux Linux kernel>=6.3.10<6.4

Linux Linux kernel>=6.4.1<6.6.124

Linux Linux kernel>=6.7<6.12.70

Linux Linux kernel>=6.13<6.18.10

Linux Linux kernel=6.4

Linux Linux kernel=6.19-rc1

Linux Linux kernel=6.19-rc2

Linux Linux kernel=6.19-rc3

Linux Linux kernel=6.19-rc4

Linux Linux kernel=6.19-rc5

Linux Linux kernel=6.19-rc6

Linux Linux kernel=6.19-rc7

Linux Linux kernel=6.19-rc8

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm-5.15*

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15*

ubuntu/linux-lowlatency-hwe-5.15*

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15*

ubuntu/linux-riscv-5.8*

ubuntu/linux*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1051.54~22.04.1

6.8.0-1051.54~22.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1052.58~22.04.1

6.8.0-1052.58~22.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1058.65~22.04.1

6.8.0-1058.65~22.04.1

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1053.56~22.04.1

6.8.0-1053.56~22.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-107.107~22.04.1

6.8.0-107.107~22.04.1

ubuntu/linux-ibm*

ubuntu/linux-ibm-6.8<6.8.0-1050.50~22.04.1

6.8.0-1050.50~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-107.107.1~22.04.1

6.8.0-107.107.1~22.04.1

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1050.53~22.04.1

6.8.0-1050.53~22.04.1

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1049.50~22.04.1

6.8.0-1049.50~22.04.1

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-107.107~22.04.1

6.8.0-107.107~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.8<6.8.1-1046.47~22.04.2

6.8.1-1046.47~22.04.2

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<6.8.0-107.107

6.8.0-107.107

ubuntu/linux-aws<6.8.0-1051.54

6.8.0-1051.54

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17<6.17.0-1010.10~24.04.1

6.17.0-1010.10~24.04.1

ubuntu/linux-azure<6.8.0-1052.58

6.8.0-1052.58

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17<6.17.0-1011.11~24.04.2

6.17.0-1011.11~24.04.2

ubuntu/linux-azure-fde<6.8.0-1058.65

6.8.0-1058.65

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1053.56

6.8.0-1053.56

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1010.10~24.04.1

6.17.0-1010.10~24.04.1

ubuntu/linux-gke<6.8.0-1049.54

6.8.0-1049.54

ubuntu/linux-gkeop<6.8.0-1036.39

6.8.0-1036.39

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17<6.17.0-20.20~24.04.1

6.17.0-20.20~24.04.1

ubuntu/linux-ibm<6.8.0-1050.50

6.8.0-1050.50

ubuntu/linux-lowlatency<6.8.0-107.107.1

6.8.0-107.107.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1050.53

6.8.0-1050.53

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1018.18

6.17.0-1018.18

ubuntu/linux-nvidia-lowlatency<6.8.0-1050.53.1

6.8.0-1050.53.1

ubuntu/linux-nvidia-tegra<6.8.0-1021.21

6.8.0-1021.21

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1017.17

6.17.0-1017.17

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1049.50

6.8.0-1049.50

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1010.10~24.04.1

6.17.0-1010.10~24.04.1

ubuntu/linux-raspi<6.8.0-1051.55

6.8.0-1051.55

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17<6.17.0-20.20.1~24.04.1

6.17.0-20.20.1~24.04.1

ubuntu/linux-xilinx<6.8.0-1028.29

6.8.0-1028.29

ubuntu/linux-bluefield<6.8.0-1017.21

6.8.0-1017.21

ubuntu/linux-raspi-realtime<6.8.0-2041.42

6.8.0-2041.42

ubuntu/linux-realtime<6.8.1-1046.47

6.8.1-1046.47

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1009.10~24.04.1

6.17.0-1009.10~24.04.1

ubuntu/linux-aws-fips<6.8.0-1051.54+fips1

6.8.0-1051.54+fips1

ubuntu/linux-azure-fips<6.8.0-1052.58+fips1

6.8.0-1052.58+fips1

ubuntu/linux-fips<6.8.0-107.107+fips1

6.8.0-107.107+fips1

ubuntu/linux-gcp-fips<6.8.0-1053.56+fips1

6.8.0-1053.56+fips1

ubuntu/linux<6.17.0-20.20

6.17.0-20.20

ubuntu/linux-aws<6.17.0-1010.10

6.17.0-1010.10

ubuntu/linux-azure<6.17.0-1011.11

6.17.0-1011.11

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<6.17.0-1010.10

6.17.0-1010.10

ubuntu/linux-oracle<6.17.0-1010.10

6.17.0-1010.10

ubuntu/linux-raspi<6.17.0-1011.11

6.17.0-1011.11

ubuntu/linux-realtime<6.17.0-1009.10

6.17.0-1009.10

ubuntu/linux-riscv<6.17.0-20.20.1

6.17.0-20.20.1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.54~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.58~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.56~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.50~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.50~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1046.47~22.04.2
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.54
Upgrade
Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.58
Upgrade
Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.11~24.04.2
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.56
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.54
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1036.39
Upgrade
Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-20.20~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.50
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.18
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1021.21
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1017.17
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.50
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.55
Upgrade
Upgrade ubuntu/linux-riscv-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-20.20.1~24.04.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.29
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.21
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2041.42
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1046.47
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1009.10~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.54+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.58+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.56+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.17.0-20.20
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.11
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.11
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.17.0-1009.10
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.17.0-20.20.1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1

Event History

Feb 13, 2026

CVE Published

via MITRE·01:29 PM

Data Sourced

via MITRE·01:29 PM

DescriptionSeverity

Data Sourced

via Red Hat·02:01 PM

DescriptionSeverityAffected Software

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·02:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4499-1

Frequently Asked Questions

What is the severity of CVE-2026-23111?

CVE-2026-23111 is a vulnerability that may impact system integrity due to the inverted genmask check in the Linux kernel.

How do I fix CVE-2026-23111?

To fix CVE-2026-23111, update the Linux kernel to the latest stable version that addresses this vulnerability.

What systems are affected by CVE-2026-23111?

CVE-2026-23111 affects the Linux kernel, specifically systems utilizing the netfilter functionality.

What are the potential consequences of CVE-2026-23111?

The potential consequences of CVE-2026-23111 include misconfigured packet processing rules, which could lead to unauthorized access.

Is there a workaround for CVE-2026-23111 if I cannot update immediately?

There are no specific workarounds for CVE-2026-23111, so it is recommended to apply the kernel update as soon as possible.

CVE-2026-23111: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-23111?

How do I fix CVE-2026-23111?

What systems are affected by CVE-2026-23111?

What are the potential consequences of CVE-2026-23111?

Is there a workaround for CVE-2026-23111 if I cannot update immediately?

Company

Resources

Contact