CVE-2024-1086Use-after-free in Linux kernel's netfilter: nf_tables component
Updated under an hour ago ()
Does this affect you?
It affects Linux Kernel and 18 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since May 30, 2024; federal agencies had to remediate by Jun 20, 2024, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-416
- Known exploited
- Added to CISA KEV May 30, 2024; federal remediation due Jun 20, 2024; known ransomware useApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 28.06% (percentile 98)
- Assigned by
- NVD analysis
- Analyzed
- Record last updated
- Aug 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Kernel linux:kernel (from the name) | from 3.15 before 6.8 | CNA record |
linux linux_kernel linux:linux_kernel | from 3.15 before 6.8 | CISA ADP |
netapp h300s_firmware netapp:h300s_firmware | all versions | NVD |
netapp h500s_firmware netapp:h500s_firmware | all versions | NVD |
netapp h700s_firmware netapp:h700s_firmware | all versions | NVD |
netapp h410s_firmware netapp:h410s_firmware | all versions | NVD |
netapp h410c_firmware netapp:h410c_firmware | all versions | NVD |
netapp bootstrap_os netapp:bootstrap_os | all versions | NVD |
linux linux_kernel linux:linux_kernel | from 3.15 before 5.15.149; from 6.1 before 6.1.76; from 6.2 before 6.6.15; from 6.7 before 6.7.3; 6.8 | NVD |
fedoraproject fedora fedoraproject:fedora | 39 | NVD |
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop | 7.0 | NVD |
redhat enterprise_linux_for_ibm_z_systems redhat:enterprise_linux_for_ibm_z_systems | 7.0_s390x | NVD |
redhat enterprise_linux_for_power_big_endian redhat:enterprise_linux_for_power_big_endian | 7.0_ppc64 | NVD |
redhat enterprise_linux_for_power_little_endian redhat:enterprise_linux_for_power_little_endian | 7.0_ppc64le | NVD |
redhat enterprise_linux_server redhat:enterprise_linux_server | 7.0 | NVD |
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation | 7.0 | NVD |
debian debian_linux debian:debian_linux | 10.0 | NVD |
netapp a250_firmware netapp:a250_firmware | all versions | NVD |
netapp 500f_firmware netapp:500f_firmware | all versions | NVD |
netapp c250_firmware netapp:c250_firmware | all versions | NVD |
References
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660patch
- https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660patch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/mailing-list
- https://github.com/Notselwyn/CVE-2024-1086exploit, third-party-advisory
- https://news.ycombinator.com/item?id=39828424issue-tracking
- https://pwning.tech/nftables/exploit, technical-description, third-party-advisory
- http://www.openwall.com/lists/oss-security/2024/04/15/2mailing-list
- http://www.openwall.com/lists/oss-security/2024/04/10/23mailing-list, patch
- http://www.openwall.com/lists/oss-security/2024/04/10/22mailing-list, patch
- http://www.openwall.com/lists/oss-security/2024/04/14/1exploit, mailing-list
- http://www.openwall.com/lists/oss-security/2024/04/17/5exploit, mailing-list
- https://security.netapp.com/advisory/ntap-20240614-0009/third-party-advisory
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.htmlmailing-list
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlmailing-list
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.