A vulnerability from February seems to have a working exploit for a LPE, according to researchers that prepared for Pwn2Own Berlin [1]. Affected code is nft/nftables.
They give a bash ‘reproducer’ that is only helpful if you have their own version of the kernel compiled with ‘printf’ sprinkled in to see how the underlying UAF happens. Without that dmesg or the output of the command does not give very good details on whether the UAF happened or not.
According to the the CVE record, a lot of Linux Kernels are affected. [2]. Patches should have been already out in the open for four months.
Mitigations: Changing SELinux to only allow modprobe_path from /usr/sbin or similar (which you should have anyway) Disabling network namespaces to prevent access to nft: sysctl -w user.max_net_namespaces=0
Removing NFT is probably not something you can do.
[1] (Reproducing CVE-2026-23111: How One Character Can Change Everything)
[2] (NVD - cve-2026-23111)