UBUNTU-CVE-2026-23111: Use After Free

Q: Which Ubuntu kernel packages are identified as affected?

The affected software list includes ubuntu/linux, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-riscv, ubuntu/linux-gke, and ubuntu/linux-gkeop.

Q: What level of access does an attacker need?

The supplied severity vector indicates local attack access and low privileges are required. No user interaction is required.

Q: What configuration or operation triggers the flaw?

The issue occurs on an aborted DELSET operation involving an nf_tables catchall map element. The failed transaction does not reactivate the catchall element as intended.

Published Feb 13, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix inverted genmask check in nftmapcatchallactivate() nftmapcatchallactivate() has an inverted element activity check compared to its non-catchall counterpart nftmapelemactivate() and compared to what is logically required. nftmapcatchallactivate() is called from the abort path to re-activate catchall map elements that were deactivated during a failed transaction. It should skip elements that are already active (they don't need re-activation) and process elements that are inactive (they need to be restored). Instead, the current code does the opposite: it skips inactive elements and processes active ones. Compare the non-catchall activate callback, which is correct: nftmapelemactivate(): if (nftsetelemactive(ext, iter->genmask)) return 0; / skip active, process inactive / With the buggy catchall version: nftmapcatchallactivate(): if (!nftsetelemactive(ext, genmask)) continue; / skip inactive, process active / The consequence is that when a DELSET operation is aborted, nftsetelemdataactivate() is never called for the catchall element. For NFTGOTO verdict elements, this means nftdatahold() is never called to restore the chain->use reference count. Each abort cycle permanently decrements chain->use. Once chain->use reaches zero, DELCHAIN succeeds and frees the chain while catchall verdict elements still reference it, resulting in a use-after-free. This is exploitable for local privilege escalation from an unprivileged user via user namespaces + nftables on distributions that enable CONFIGUSERNS and CONFIGNFTABLES. Fix by removing the negation so the check matches nftmapelemactivate(): skip active elements, process inactive ones.

Affected Software

188 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm-5.15*

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15*

ubuntu/linux-lowlatency-hwe-5.15*

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15*

ubuntu/linux-riscv-5.8*

ubuntu/linux*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1051.54~22.04.1

6.8.0-1051.54~22.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1052.58~22.04.1

6.8.0-1052.58~22.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1058.65~22.04.1

6.8.0-1058.65~22.04.1

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1053.56~22.04.1

6.8.0-1053.56~22.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-107.107~22.04.1

6.8.0-107.107~22.04.1

ubuntu/linux-ibm*

ubuntu/linux-ibm-6.8<6.8.0-1050.50~22.04.1

6.8.0-1050.50~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-107.107.1~22.04.1

6.8.0-107.107.1~22.04.1

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1050.53~22.04.1

6.8.0-1050.53~22.04.1

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1049.50~22.04.1

6.8.0-1049.50~22.04.1

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-107.107~22.04.1

6.8.0-107.107~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.8<6.8.1-1046.47~22.04.2

6.8.1-1046.47~22.04.2

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<6.8.0-107.107

6.8.0-107.107

ubuntu/linux-aws<6.8.0-1051.54

6.8.0-1051.54

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17<6.17.0-1010.10~24.04.1

6.17.0-1010.10~24.04.1

ubuntu/linux-azure<6.8.0-1052.58

6.8.0-1052.58

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17<6.17.0-1011.11~24.04.2

6.17.0-1011.11~24.04.2

ubuntu/linux-azure-fde<6.8.0-1058.65

6.8.0-1058.65

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia<6.8.0-1039.42

6.8.0-1039.42

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1053.56

6.8.0-1053.56

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1010.10~24.04.1

6.17.0-1010.10~24.04.1

ubuntu/linux-gke<6.8.0-1049.54

6.8.0-1049.54

ubuntu/linux-gkeop<6.8.0-1036.39

6.8.0-1036.39

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17<6.17.0-20.20~24.04.1

6.17.0-20.20~24.04.1

ubuntu/linux-ibm<6.8.0-1050.50

6.8.0-1050.50

ubuntu/linux-lowlatency<6.8.0-107.107.1

6.8.0-107.107.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1050.53

6.8.0-1050.53

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1018.18

6.17.0-1018.18

ubuntu/linux-nvidia-lowlatency<6.8.0-1050.53.1

6.8.0-1050.53.1

ubuntu/linux-nvidia-tegra<6.8.0-1021.21

6.8.0-1021.21

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1017.17

6.17.0-1017.17

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1049.50

6.8.0-1049.50

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1010.10~24.04.1

6.17.0-1010.10~24.04.1

ubuntu/linux-raspi<6.8.0-1051.55

6.8.0-1051.55

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17<6.17.0-20.20.1~24.04.1

6.17.0-20.20.1~24.04.1

ubuntu/linux-xilinx<6.8.0-1028.29

6.8.0-1028.29

ubuntu/linux-bluefield<6.8.0-1017.21

6.8.0-1017.21

ubuntu/linux-raspi-realtime<6.8.0-2041.42

6.8.0-2041.42

ubuntu/linux-realtime<6.8.1-1046.47

6.8.1-1046.47

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1009.10~24.04.1

6.17.0-1009.10~24.04.1

ubuntu/linux-aws-fips<6.8.0-1051.54+fips1

6.8.0-1051.54+fips1

ubuntu/linux-azure-fips<6.8.0-1052.58+fips1

6.8.0-1052.58+fips1

ubuntu/linux-fips<6.8.0-107.107+fips1

6.8.0-107.107+fips1

ubuntu/linux-gcp-fips<6.8.0-1053.56+fips1

6.8.0-1053.56+fips1

ubuntu/linux<6.17.0-20.20

6.17.0-20.20

ubuntu/linux-aws<6.17.0-1010.10

6.17.0-1010.10

ubuntu/linux-azure<6.17.0-1011.11

6.17.0-1011.11

ubuntu/linux-azure-fde*

ubuntu/linux-gcp<6.17.0-1010.10

6.17.0-1010.10

ubuntu/linux-oracle<6.17.0-1010.10

6.17.0-1010.10

ubuntu/linux-raspi<6.17.0-1011.11

6.17.0-1011.11

ubuntu/linux-realtime<6.17.0-1009.10

6.17.0-1009.10

ubuntu/linux-riscv<6.17.0-20.20.1

6.17.0-20.20.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.54~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.58~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.56~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.50~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.50~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107~22.04.1
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1046.47~22.04.2
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.54
Upgrade
Upgrade ubuntu/linux-aws-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.58
Upgrade
Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.11~24.04.2
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.65
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1039.42
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.56
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.54
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1036.39
Upgrade
Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-20.20~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.50
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.18
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1050.53.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1021.21
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1017.17
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1049.50
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.55
Upgrade
Upgrade ubuntu/linux-riscv-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-20.20.1~24.04.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.29
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.21
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2041.42
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1046.47
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1009.10~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1051.54+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.58+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-107.107+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.56+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.17.0-20.20
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.11
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.10
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.17.0-1011.11
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.17.0-1009.10
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.17.0-20.20.1
Configuration
Remove the negation from the activity check so the function skips active catchall elements and processes inactive ones, matching nft_mapelem_activate().
Linux kernel nftables nft_map_catchall_activate() genmask activity check = nft_set_elem_active(ext, genmask)

Event History

Feb 13, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

The affected software list includes ubuntu/linux, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-riscv, ubuntu/linux-gke, and ubuntu/linux-gkeop.

What level of access does an attacker need?

The supplied severity vector indicates local attack access and low privileges are required. No user interaction is required.

What configuration or operation triggers the flaw?

The issue occurs on an aborted DELSET operation involving an nf_tables catchall map element. The failed transaction does not reactivate the catchall element as intended.

UBUNTU-CVE-2026-23111: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

What level of access does an attacker need?

What configuration or operation triggers the flaw?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu kernel packages are identified as affected?

What level of access does an attacker need?

What configuration or operation triggers the flaw?