CVE-2024-1085: Use-after-free in Linux kernel's netfilter: nf_tables component

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-31 · updated 2026-06-17
Weakness: CWE-416

Description

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability. We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7.

Affected products

Linux kernel: from 5.13 before 5.15.148; from 5.16 before 6.1.75; from 6.2 before 6.6.14; from 6.7 before 6.7.2 — fixed in 5.15.148, 6.1.75, 6.6.14, 6.7.2

How to fix

Upgrade to a fixed version: Linux kernel 5.15.148, 6.1.75, 6.6.14, 6.7.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1085 or the next vulnerability affects your stack