CVE-2024-1086

This is a serious bug in the Linux kernel’s network filtering feature (nf_tables). In simple terms, it’s like the system frees up an important object, but later code still tries to use it, which can let an attacker “break out” and gain higher control of the machine. Because it’s been used in ransomware campaigns, it can quickly turn an initial access into a full system takeover.

This matters if you run Linux (including Fedora, Red Hat Enterprise Linux, Enterprise Linux for IBM z Systems, Enterprise Linux for Power, and Debian) on servers or endpoints where attackers may already reach the system’s ability to trigger the nf_tables path. The risk is tied to local code execution capability (attackers typically need a way to run code/trigger the vulnerable path) rather than a simple “anyone from the internet can hit it” scenario. Also, for systems where the nf_tables feature is not reachable or not used, exposure is reduced; otherwise, you should treat it as a real priority.

RED: Attackers are already using this issue in the real world (it is in CISA KEV tied to ransomware activity). CISA requires action by 2024-06-20, so your next step should be to patch and verify kernel versions immediately. Follow your vendor’s kernel security update as the primary mitigation.

1. Confirm what you’re running

• Record the output of: uname -r
• Identify your distro and kernel release stream (for example, whether you’re on a 5.15.y kernel line or another 6.x line).

2. Determine whether your kernel is patched

• The publicly identified fixed versions are:
  • Linux kernel fixed in 5.15.149
  • Linux kernel fixed in 6.8
• If your running kernel version is earlier than those, you should assume you are vulnerable until you install the vendor kernel update that includes the fix.

3. Upgrade using your vendor’s security updates

• For Fedora / Red Hat Enterprise Linux / Debian / Enterprise Linux variants: install the vendor-provided kernel security update that incorporates the fix (don’t rely only on “manual” patches unless your team is set up for it).
• After installation, reboot if your distro requires reboot for kernel changes.
• Re-check uname -r and confirm you are now on (or above) the fixed kernel version in your branch:

  • = 5.15.149 for the 5.15.y branch

  • = 6.8 for the 6.x branch

4. If you cannot patch right away

• Follow your vendor’s mitigation guidance for nf_tables when a fixed kernel update isn’t available for your exact release.
• Reduce attack surface by limiting how attackers can reach or trigger nf_tables behavior on the host (for example, ensure the vulnerable feature/path is not exposed within your environment), until you can update the kernel.

5. What to monitor after patching

• Confirm the system is actually running the updated kernel (post-reboot verification).
• Review security logs for signs of exploitation attempts or privilege escalation around the timeframe when updates were due.

6. KEV due date

• This issue is in CISA KEV with a remediation due date of 2024-06-20, so treat patching/mitigation as time-critical.

CVE-2024-1086 is a CWE-416 use-after-free in the Linux kernel netfilter nf_tables component. The nf_tables code path can end up freeing memory that is still referenced later, which can be triggered under specific conditions involving hook verdict handling (including interactions between drop verdicts and accepted-like behavior). Real-world exploitation is confirmed via CISA KEV (listed for use in ransomware campaigns), and the expected action is to apply vendor mitigations or discontinue use if mitigations aren’t available. A public proof-of-concept exists, and exploit maturity is higher given KEV confirmation. Public EPSS prediction data is not the driver here; the KEV listing indicates active risk. Fixed versions provided by the patch information include Linux kernel 5.15.149 and 6.8, with additional remediation guidance available via the linked kernel commit and oss-security notifications.