What’s Vulnerable › Vulnerabilities
CVE-2024-1086: Linux Kernel Use-After-Free Vulnerability
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2024-05-30
- EPSS: 28.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-01-31 · updated 2026-08-07
- Weakness: CWE-416
Description
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
Affected products
- Debian Linux: 10.0
- Fedoraproject Fedora: 39
- Linux kernel: from 3.15 before 5.15.149; from 6.1 before 6.1.76; from 6.2 before 6.6.15; from 6.7 before 6.7.3; 6.8-rc1 — fixed in 5.15.149, 6.1.76, 6.6.15, 6.7.3
- NetApp 500F Firmware: all versions
- NetApp A250 Firmware: all versions
- NetApp Bootstrap Os: all versions
- NetApp C250 Firmware: all versions
- NetApp H300S Firmware: all versions
- NetApp H410C Firmware: all versions
- NetApp H410S Firmware: all versions
- NetApp H500S Firmware: all versions
- NetApp H700S Firmware: all versions
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux For Ibm Z Systems: 7.0_s390x
- RedHat Enterprise Linux For Power Big Endian: 7.0_ppc64
- RedHat Enterprise Linux For Power Little Endian: 7.0_ppc64le
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Workstation: 7.0
How to fix
Upgrade to a fixed version: Linux kernel 5.15.149, 6.1.76, 6.6.15, 6.7.3. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2024/04/10/22
- http://www.openwall.com/lists/oss-security/2024/04/10/23
- http://www.openwall.com/lists/oss-security/2024/04/14/1
- http://www.openwall.com/lists/oss-security/2024/04/15/2
- http://www.openwall.com/lists/oss-security/2024/04/17/5
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
- https://github.com/Notselwyn/CVE-2024-1086
- https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/
- https://news.ycombinator.com/item?id=39828424
Get alerted when CVE-2024-1086 or the next vulnerability affects your stack