CVE-2024-1086: Linux kernel nf_tables use-after-free allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a locally exploitable kernel privilege escalation with public exploit code, KEV listing and known ransomware use, though it requires local access rather than being remotely reachable.

What it is

The Linux kernel's netfilter nf_tables component has a use-after-free in nft_verdict_init(), where positive drop errors are accepted and nf_hook_slow() can then trigger a double free when NF_DROP is issued with a drop error resembling NF_ACCEPT. A local attacker can turn this into privilege escalation, and the flaw is tracked in CISA KEV with known ransomware campaign use.

Impact

An attacker who can run code locally on a vulnerable host can corrupt kernel memory and escalate to root, gaining full control of the system.

Attack surface

Reached locally through the netfilter nf_tables interface; the CVSS vector AV:L/PR:L/UI:N indicates a local attacker with low privileges and no user interaction. No remote or unauthenticated path is described.

Exploitation

CISA KEV lists it as actively exploited with known ransomware campaign use, and public exploit code and technical write-ups are referenced. EPSS is 0.28058 (98th percentile), indicating high predicted exploitation activity.

What to do

• Apply the upstream kernel patch (commit f342de4e2f33e0e39165d8639387aa6c19dff660) or the vendor kernel update for your distribution.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the affected product if no mitigation is available.
• Restrict local shell and container access to trusted users, since exploitation requires local code execution.
• Where nf_tables is not needed, disable or block the relevant netfilter modules to reduce exposure.
• Track vendor advisories from Red Hat, Debian, Fedora and NetApp for updated packages covering the listed products.

Detection

• Monitor for unexpected privilege escalation or root shell creation from low-privileged local accounts.
• Watch for unusual nf_tables or netfilter configuration changes and kernel crash or double-free indicators in logs.
• Hunt for known public exploit artifacts or tooling associated with CVE-2024-1086 on hosts.
• Correlate local process execution with kernel memory corruption symptoms such as oops or panic events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.