# CVE-2024-1086: Use-after-free in Linux kernel's netfilter: nf_tables component

> CVE-2024-1086 (GitHub advisory GHSA-gfh2-2mj9-m2cx) is a high-severity vulnerability with a CVSS 3.1 base score of 7.8, classed as Use After Free (CWE-416), in git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git (Git repository). Affected versions: >= 3.15, < 6.8. It is fixed in 6.8. CISA lists it as a known exploited vulnerability (added 30 May 2024).

Canonical page: https://cveminer.com/vulnerabilities/CVE-2024-1086

| Field | Value |
| --- | --- |
| CVE | CVE-2024-1086 |
| GHSA | GHSA-gfh2-2mj9-m2cx |
| Severity | High |
| CVSS 3.1 | 7.8 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (GitHub Advisory Database) |
| CWE | CWE-416 Use After Free |
| EPSS | 28.05% (higher than 97% of CVEs) |
| CISA KEV | Listed 30 May 2024, due 20 Jun 2024 |
| SSVC | exploitation active, automatable no, technical impact total |
| Published | 31 Jan 2024 |
| Modified | 7 Aug 2026 |

## Description

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.

We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git | GIT | none | >= 3.15, < 6.8 | 6.8 |

## Fix commits

- Patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
- Release: https://git.kernel.org/stable/c/e8f897f4afef0031fe618a8e94127a0934896aba (6.8)

## Questions

**What is the GHSA ID for CVE-2024-1086?**

GitHub tracks CVE-2024-1086 as GHSA-gfh2-2mj9-m2cx.

**What is the CVSS score of CVE-2024-1086?**

CVE-2024-1086 has a CVSS 3.1 base score of 7.8 (High), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

**Which versions are affected by CVE-2024-1086?**

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git (GIT): >= 3.15, < 6.8.

**How do I fix CVE-2024-1086?**

Upgrade to 6.8 or later. The fix is in commit f342de4.

**Is CVE-2024-1086 exploited in the wild?**

CISA lists it as a known exploited vulnerability (added 30 May 2024). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 28.05% chance of exploitation in the next 30 days, higher than 97% of CVEs.

## References

- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660 (fix)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1086.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2024-1086 (advisory)
- https://security.netapp.com/advisory/ntap-20240614-0009/ (advisory)
- https://github.com/advisories/GHSA-gfh2-2mj9-m2cx (advisory)
- https://github.com/Notselwyn/CVE-2024-1086 (evidence)
- http://www.openwall.com/lists/oss-security/2024/04/10/22
- http://www.openwall.com/lists/oss-security/2024/04/10/23
- http://www.openwall.com/lists/oss-security/2024/04/14/1
- http://www.openwall.com/lists/oss-security/2024/04/15/2
- http://www.openwall.com/lists/oss-security/2024/04/17/5
- https://git.kernel.org
- https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/
- https://news.ycombinator.com/item?id=39828424
- https://pwning.tech/nftables/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2024-1086), compiled from GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.