Linux Kernel nftables Vulnerability Allows Local Privilege Escalation
A race condition in the Linux Kernel's nftables component, ZDI-26-686, allows local attackers to escalate privileges after gaining initial code execution.
A critical vulnerability has been identified within the Linux Kernel's nftables component, allowing local attackers to escalate their privileges. The flaw, tracked as ZDI-26-686 and assigned CVE-2026-74565, requires an attacker to first possess the ability to execute low-privileged code on the target system.
The vulnerability stems from a race condition in how the kernel handles nft_object objects. Specifically, the issue arises due to a lack of proper locking mechanisms when operations are performed on these objects. This oversight can be exploited by an attacker to gain elevated privileges and execute arbitrary code within the context of the kernel, a highly sensitive area of the operating system.
The Common Vulnerability Scoring System (CVSS) has rated this vulnerability at 7.8, indicating a high severity. Successful exploitation could lead to a complete compromise of the affected system, as an attacker could potentially gain administrative control.
Zero Day Initiative (ZDI), the organization that disclosed the vulnerability, reported that the issue was initially reported to the vendor on July 14, 2026. A coordinated public release of the advisory occurred on September 14, 2026, with an update to the advisory also published on the same day.
Linux has since issued an update to address this vulnerability. Developers can find the specific fix in the Linux kernel's commit history, noted as commit f4f699790590bd0896c48a71e9232a65198f92f0. This patch is crucial for systems administrators to apply to protect against potential exploitation.
The vulnerability was discovered and reported by GangMin Kim. The disclosure timeline highlights a typical process where a vulnerability is privately reported to the vendor, allowing time for a fix to be developed before public disclosure.
This discovery underscores the ongoing challenges in maintaining the security of complex software like the Linux Kernel. Even well-established components like nftables can harbor vulnerabilities that, when combined with other factors like prior code execution, can lead to significant security risks. Users and administrators are strongly advised to apply the latest kernel updates promptly.