CVE-2024-1086
Linux Kernel Use-After-Free Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 20 June 2024). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 28.06% probability · 98th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Listed 30 May 2024 · due 20 June 2024 · used in ransomware campaigns
- Weakness
- CWE-416
- Affected
- netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h410s firmware · netapp/h410c firmware · netapp/bootstrap os · linux/linux kernel · fedoraproject/fedora · redhat/enterprise linux desktop · redhat/enterprise linux for ibm z systems · redhat/enterprise linux for power big endian · redhat/enterprise linux for power little endian · redhat/enterprise linux server · redhat/enterprise linux workstation · debian/debian linux · netapp/a250 firmware · netapp/500f firmware · netapp/c250 firmware
- Source
- cve-coordination@google.com
EPSS 28.1% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
CISA notes
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660; https://nvd.nist.gov/vuln/detail/CVE-2024-1086
References
- http://www.openwall.com/lists/oss-security/2024/04/10/22Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2024/04/10/23Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2024/04/14/1Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2024/04/15/2Mailing List
- http://www.openwall.com/lists/oss-security/2024/04/17/5Exploit, Mailing List
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660Patch
- https://github.com/Notselwyn/CVE-2024-1086Exploit, Third Party Advisory
- https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660Patch
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.htmlMailing List
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlMailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/Mailing List
- https://news.ycombinator.com/item?id=39828424Issue Tracking
- https://pwning.tech/nftables/Exploit, Technical Description, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240614-0009/Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/04/10/22Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2024/04/10/23Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2024/04/14/1Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2024/04/15/2Mailing List
- http://www.openwall.com/lists/oss-security/2024/04/17/5Exploit, Mailing List
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660Patch
- https://github.com/Notselwyn/CVE-2024-1086Exploit, Third Party Advisory
- https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660Patch
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.htmlMailing List
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlMailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/Mailing List
- https://news.ycombinator.com/item?id=39828424Issue Tracking
- https://pwning.tech/nftables/Exploit, Technical Description, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240614-0009/Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.