High 7.8Known exploited (CISA KEV)Published Jan 31, 2024

CVE-2024-1086Use-after-free in Linux kernel's netfilter: nf_tables component

Updated under an hour ago (Oct 26, 2026, 4:50 PM ET)

Does this affect you?

It affects Linux Kernel and 18 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since May 30, 2024; federal agencies had to remediate by Jun 20, 2024, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux Kernel

Exploited in the last 30 days

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Added to CISA KEV May 30, 2024; federal remediation due Jun 20, 2024; known ransomware useApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 28.06% (percentile 98)
Assigned by: Google
NVD analysis: Analyzed
Record last updated: Aug 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Kernel linux:kernel (from the name)	from 3.15 before 6.8	CNA record
linux linux_kernel linux:linux_kernel	from 3.15 before 6.8	CISA ADP
netapp h300s_firmware netapp:h300s_firmware	all versions	NVD
netapp h500s_firmware netapp:h500s_firmware	all versions	NVD
netapp h700s_firmware netapp:h700s_firmware	all versions	NVD
netapp h410s_firmware netapp:h410s_firmware	all versions	NVD
netapp h410c_firmware netapp:h410c_firmware	all versions	NVD
netapp bootstrap_os netapp:bootstrap_os	all versions	NVD
linux linux_kernel linux:linux_kernel	from 3.15 before 5.15.149; from 6.1 before 6.1.76; from 6.2 before 6.6.15; from 6.7 before 6.7.3; 6.8	NVD
fedoraproject fedora fedoraproject:fedora	39	NVD
1–10 of 20

References

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660	patch
https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660	patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/	mailing-list
https://github.com/Notselwyn/CVE-2024-1086	exploit, third-party-advisory
https://news.ycombinator.com/item?id=39828424	issue-tracking
https://pwning.tech/nftables/	exploit, technical-description, third-party-advisory
http://www.openwall.com/lists/oss-security/2024/04/15/2	mailing-list
http://www.openwall.com/lists/oss-security/2024/04/10/23	mailing-list, patch
http://www.openwall.com/lists/oss-security/2024/04/10/22	mailing-list, patch
http://www.openwall.com/lists/oss-security/2024/04/14/1	exploit, mailing-list
1–10 of 15

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.