CVE-2024-1086

Confirmed PUBLISHED

Use-after-free in Linux kernel's netfilter: nf_tables component

Linux · Kernel

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

7.8 High

At a Glance

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

linux nessus_scanner cisa malware

CVE Published: Jan 31, 2024
Exploitation Reported: May 30, 2024
CVSS: 7.8 High
EPSS: —

Low complexity No user interaction

Affected Versions

Vendor	Product	Version	Status
linux	linux_kernel	3.15 to < 6.8	Affected
Linux	Kernel kernel	3.15 to < 6.8	Affected

CVE References

Patch — git.kernel.org git.kernel.org · Patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/co...
kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660 kernel.dance · CVE Record https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660
lists.fedoraproject.org/archives/list/[email protected]... lists.fedoraproject.org · CVE Record https://lists.fedoraproject.org/archives/list/package-announce@lists....
GitHub — Notselwyn/CVE-2024-1086 github.com · CVE Record https://github.com/Notselwyn/CVE-2024-1086
news.ycombinator.com/item news.ycombinator.com · CVE Record https://news.ycombinator.com/item?id=39828424

Show 9 more references

pwning.tech/nftables pwning.tech · CVE Record https://pwning.tech/nftables/
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2024/04/15/2
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2024/04/10/23
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2024/04/10/22
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2024/04/14/1
OSS-Security Mailing List openwall.com · CVE Record http://www.openwall.com/lists/oss-security/2024/04/17/5
security.netapp.com/advisory/ntap-20240614-0009 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20240614-0009/
lists.debian.org/debian-lts-announce/2024/06/msg00016.html lists.debian.org · CVE Record https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
lists.debian.org/debian-lts-announce/2024/06/msg00020.html lists.debian.org · CVE Record https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2024-05-30 00:00 UTC

CVSS Scores

CVSS v3.1 7.8 High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2024-05-30 00:00:00 UTC · CISA

Used in malware

Recorded 2026-06-02 14:08:23 UTC · CISA

Proof of concept available

Recorded 2024-03-20 21:16:41 UTC · GitHub

Weaknesses (CWE)

CWE-416

Use After Free

Scanner Integrations

Scanner	Reference	Detected
Nessus	https://www.tenable.com/plugins/nessus/236061	Jun 02, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

LLfam/CVE-2024-1086

github · Created 2024-12-16 17:33:13 UTC · 14 stars

Alicey0719/docker-POC_CVE-2024-1086

github · Created 2024-04-03 13:09:22 UTC · 2 stars

Notselwyn/CVE-2024-1086

github · Created 2024-03-20 21:16:41 UTC · 2358 stars

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2024-1086

{
  "cve_id": "CVE-2024-1086",
  "title": "Use-after-free in Linux kernel\'s netfilter: nf_tables component",
  "affected_vendor": "Linux",
  "affected_product": "Kernel",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2024-1086

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API