CVE-2024-1086: Linux Kernel Use-After-Free Vulnerability
Vulnerability summary
CVE-2024-1086 is a high (CVSS 7.8) Use After Free vulnerability in Linux Kernel. It is known to be exploited: CISA lists it, first on 30-05-2024. It has been used in ransomware campaigns. EPSS estimates a 28.06% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 4 public exploits are recorded.
Known ransomware use (CISA, 30-05-2024)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 75 · Related 56Timeline
- 31-01-2024PublishedVulnerability first disclosed.
- 30-05-2024Added to CISA KEVExploitedLinux Kernel Use-After-Free Vulnerability
- 20-06-2024CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 07-08-2026Last modifiedVulnerability information updated.
Description
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · Red hatEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
28.06%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 28.06% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 30-05-2024
- Federal due date
- 20-06-2024
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2024-1086
Public exploits
4 foundCve 2024 1086
Maturity: poc
Exploit Reference (pwning.tech)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu116 products
- linux< 4.4.0-252.286 | < 4.15.0-223.235 | < 5.4.0-174.193 | < 5.15.0-101.111
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 4.4.0-1129.135 | < 4.4.0-1167.182 | < 4.15.0-1166.179 | < 5.4.0-1121.131 | < 5.15.0-1056.61
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Redhat58 products
- enterprise_linux_desktop7.0
- enterprise_linux_for_ibm_z_systems7.0_s390x
- enterprise_linux_for_power_big_endian7.0_ppc64
- enterprise_linux_for_power_little_endian7.0_ppc64le
- enterprise_linux_server7.0
Debian2 products
- linux< 6.1.76-1 | < 6.6.15-1
- debian_linuxEOL10.0
Linux2 products
- kernel≥ 3.15, < 6.8
- linux_kernel≥ 3.15, < 5.15.149 | ≥ 6.1, < 6.1.76 | ≥ 6.2, < 6.6.15 | ≥ 6.7, < 6.7.3 | 6.8:rc1
Suse2 products
- kgraft-patch-SLE12-SP5_Update_51&distro=SUSE Linux Enterprise Live Patching 12 SP5< 6-2.1
- kgraft-patch-SLE12-SP5_Update_52&distro=SUSE Linux Enterprise Live Patching 12 SP5< 5-2.1
Fedoraproject1 product
- fedoraEOL39
7 vendors · 190 products
References
59 links- lists.fedoraproject.org/archives/…Mailing List
- news.ycombinator.com/item?id=39828424Issue Tracking
- www.openwall.com/lists/oss-security/2024/04/15/2Mailing List
Show all 59 references
- security.netapp.com/advisory/ntap-20240614-0009/Third Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086Government ResourceUS Government Resource
