A one-character mistake in the Linux kernel’s nf_tables packet-filtering code (CVE-2026-23111) lets anyone with a low-privilege shell or container escape to root. Researchers at Exodus Intelligence and FuzzingLabs both published working exploits. Exodus’s write-up, released June 8, shows how Oliver Sieber triggered a use-after-free, bypassed kernel memory protections and grabbed root inside and outside container namespaces. FuzzingLabs demonstrated a different version on RHEL 10 ahead of Pwn2Own Berlin on April 16. The patch upstream, merged February 5, simply removed the inverted check in one line. Most modern distros shipped vulnerable kernels with nf_tables and unprivileged user namespaces enabled by default. Ubuntu rates the flaw CVSS 7.8; Debian, Ubuntu (22.04, 24.04, 25.10) and Red Hat have advisories. Debian backported it to Bullseye LTS and fixed Bookworm/Trixie. SUSE and Amazon Linux users should also check their vendor’s advisory. Until you update and reboot, any compromised non-root account can chain this bug into full root on the host. CVE-2026-23111 arrives amid a wave of local-root exploits—Copy Fail, Dirty Frag, Fragnesia, DirtyDecrypt and a nine-year-old ptrace gap. They differ technically but share the same risk: unprivileged apps or containers routinely turn into root. Synacktiv links the surge to AI-aided patch analysis and recommends tightening default kernel settings, especially disabling user namespaces until patches roll out. No in-the-wild attacks have been reported yet.