{"id":"CVE-2024-1086","kind":"vulnerability","aliases":["CVE-2024-1086"],"related":[],"title":"A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve…","description":"A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\n\n\nThe nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.\n\n\n\nWe recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.","summary":"The Linux kernel's netfilter nf_tables component has a use-after-free bug. A local user can use it to gain root privileges on the machine.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-05-30T00:00:00+00:00","products":[{"name":"netapp h300s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h500s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h700s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410s firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp h410c firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp bootstrap os","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.149"],"affected":">= 3.15, < 5.15.149","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.1.76"],"affected":">= 6.1, < 6.1.76","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.6.15"],"affected":">= 6.2, < 6.6.15","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.7.3"],"affected":">= 6.7, < 6.7.3","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 6.8","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 39","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux for ibm z systems","fixed":[],"affected":"= 7.0_s390x","ecosystem":"vendor"},{"name":"redhat enterprise linux for power big endian","fixed":[],"affected":"= 7.0_ppc64","ecosystem":"vendor"},{"name":"redhat enterprise linux for power little endian","fixed":[],"affected":"= 7.0_ppc64le","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"netapp a250 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp 500f firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp c250 firmware","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kernel","linux","multi-user-hosts","ransomware","self-hosted"],"not_affected_if":["no-local-untrusted-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2024-01-31T13:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:45+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:58:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","impact":"high","summary":"The Linux kernel's netfilter nf_tables component has a use-after-free bug. A local user can use it to gain root privileges on the machine.","category":"infrastructure","who_cares":["linux","kernel","self-hosted","multi-user-hosts"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains root and takes full control of the machine","analyst_note":"Sources list it as known exploited (CISA KEV, ransomware tag) but give no fixed kernel versions or check commands; find the fixed kernel versions and distro advisories for CVE-2024-1086.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-local-untrusted-users"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000434,"input_tokens":2811,"output_tokens":306,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1086':23A,26A '-2024':22A,25A '500f':96A 'a250':93A 'accept':206C 'achiev':20A,162C 'allow':171C 'big':73A 'bootstrap':43A 'bug':129B 'c250':99A 'caus':189C 'commit':211C 'compon':15A,122B,157C 'cve':21A,24A 'debian':90A 'desktop':60A 'doubl':191C 'drop':175C,196C,201C 'endian':74A,81A 'enterprise':58A,62A,69A,76A,83A,87A 'error':176C,202C 'escal':165C 'exploit':18A,103B,160C 'f342de4e2f33e0e39165d8639387aa6c19dff660':212C 'fedora':56A 'fedoraproject':55A 'firmware':29A,32A,35A,38A,41A,94A,97A,100A 'for':64A,71A,78A 'free':5A,128B,147C,192C 'function':170C,187C 'gain':137B 'h300s':28A 'h410c':40A 'h410s':37A 'h500s':31A 'h700s':34A 'henc':182C 'hook':179C,185C 'host':110B,114B 'ibm':65A 'infrastructur':104B 'init':169C 'issu':198C 'kernel':10A,46A,48A,50A,52A,54A,102A,105B,117B,152C 'linux':9A,45A,47A,49A,51A,53A,59A,63A,70A,77A,84A,88A,91A,101A,106B,116B,151C 'little':80A 'local':131B,163C 'machin':142B 'multi':108B 'multi-user-host':107B 'netapp':27A,30A,33A,36A,39A,42A,92A,95A,98A 'netfilt':12A,119B,154C 'nf':13A,120B,155C,184C,195C,205C 'nft':167C 'os':44A 'past':210C 'posit':172C 'power':72A,79A 'privileg':139B,164C 'ransomwar':111B 'recommend':208C 'redhat':57A,61A,68A,75A,82A,86A 'resembl':204C 'root':138B 'self':113B 'self-host':112B 'server':85A 'slow':186C 'systems':67A 'tabl':14A,121B,156C 'upgrad':209C 'use':3A,126B,134B,145C 'use-after-fre':2A,125B,144C 'user':109B,132B 'valu':173C 'verdict':168C,180C 'vulner':6A,148C,193C 'within':177C 'workstation':89A 'z':66A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-01-31T13:15:10+00:00","kev":{"dateAdded":"2024-05-30","dueDate":"2024-06-20","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve-coordination@google.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-1086","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-1086","severity":null,"published_at":"2024-05-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-1086","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1086","severity":null,"published_at":"2024-01-31T13:15:10+00:00","modified_at":"2026-08-07T19:59:58+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}