CVE-2024-1086

Advisory lineage Upstream: 0 Downstream: 85
Analyzed
Published: 31 Jan 2024, 12:14
Last modified:21 Oct 2025, 23:05

Vulnerability Summary

Overall Risk (default)
high
58/100
CVSS Score
7.8 HIGH
v3.1 (cve.org)
EPSS Score
85.26% CRITICAL
85% probability +0.47%
KEV
Listed
CISA
1 listing
Ransomware
Known Use
Public exploits
4 found
Dark Web
Not detected

Timeline

31 Jan 2024, 12:14
Published
Vulnerability first disclosed
30 May 2024, 00:00
Added to CISA KEV
Linux Kernel Use-After-Free Vulnerability
20 Jun 2024, 00:00
CISA Remediation Due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
21 Oct 2025, 23:05
Last Modified
Vulnerability information updated

Description

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 85.26%• Percentile: 99%

Techniques & Countermeasures

  • CWE-416•Use After Free

    The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

  • debian•debian_linux

    10.0

  • fedoraproject•fedora

    39

  • Unknown•Kernel

    ≥ 3.15, < 6.8

  • linux•linux_kernel

    ≥ 3.15, < 5.15.149 | ≥ 6.1, < 6.1.76 | ≥ 6.2, < 6.6.15 | ≥ 6.7, < 6.7.3 | 6.8:rc1

  • netapp•500f_firmware

    na

  • netapp•a250_firmware

    na

  • netapp•c250_firmware

    na

  • redhat•enterprise_linux_desktop

    7.0

  • redhat•enterprise_linux_for_ibm_z_systems

    7.0_s390x

  • redhat•enterprise_linux_for_power_big_endian

    7.0_ppc64

  • redhat•enterprise_linux_for_power_little_endian

    7.0_ppc64le

  • redhat•enterprise_linux_server

    7.0

  • redhat•enterprise_linux_workstation

    7.0

References (15)