CVE-2024-1086

Use-after-free in Linux kernel's netfilter: nf_tables component

High 7.8
Exploited: added to CISA KEV 30 May 2024
Used in ransomware campaigns

Description

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

Key facts

Published: 31 Jan 2024
Last changed: 7 Aug 2026
Assigned by: Google
KEV added: 30 May 2024
KEV fix due: 20 Jun 2024
Used in ransomware: Yes, according to CISA
EPSS: 28.058% likely to be exploited in the next 30 days, higher than 98.136% of CVEs (scores for 15 Nov 2026)
SSVC (CISA): Exploitation: active; Automatable: no; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

7.8CVSS 3.1, Highfrom the CNA (Google)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-233 Privilege Escalation (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Vendor	Product	Versions
Linux	Kernel	Default status: unaffected 3.15 up to but excluding 6.8 (affected)