Actively exploited in the wild. This CVE is on the CISA Known Exploited Vulnerabilities list — treat remediation as urgent. Federal remediation due by 20 Jun 2024.Known ransomware use
Linux KernelOperating system · Linux
CVE-2024-1086
HIGH · 7.8 CVSS v3.1Published 2024-01-31
Fix available
A fix is available.Upgrade to 5.15.149 / 6.1.76 or later.
In the wildRansomwarePublic exploitZero-clickPatch available
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · unedited
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.
The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.
We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidence
A use-after-free vulnerability in the Linux kernel's netfilter nf_tables component allows local privilege escalation. The nft_verdict_init() function incorrectly accepts positive values as drop errors within the hook verdict, causing nf_hook_slow() to trigger a double free when NF_DROP is issued with a drop error resembling NF_ACCEPT.
MitigationUpgrade the Linux kernel past commit f342de4e2f33e0e39165d8639387aa6c19dff660, or apply the specific patch that addresses the incorrect validation of drop error values in nft_verdict_init().
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
Enterprise Linux For Ibm Z SystemsOperating system
Affected:= 7.0_s390x
Enterprise Linux For Power Big EndianOperating system
Affected:= 7.0_ppc64
Enterprise Linux For Power Little EndianOperating system
Affected:= 7.0_ppc64le
Enterprise Linux ServerOperating system
Affected:= 7.0
Enterprise Linux WorkstationOperating system
Affected:= 7.0
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checks
Work through these to decide whether this CVE applies to you.
Check your kernel version
Run 'uname -r' or 'cat /proc/version' to get the running kernel version
Affected if The kernel version falls within these ranges: >= 3.15 and < 5.15.149; >= 6.1 and < 6.1.76; >= 6.2 and < 6.6.15; >= 6.7 and < 6.7.3; or is exactly 6.8
Verify nf_tables subsystem is loaded
Run 'lsmod | grep nf_tables' to check if the nf_tables kernel module is loaded
Affected if The nf_tables module is loaded and active in memory
Check for active nftables rules
Run 'nft list ruleset 2>/dev/null' to see if any nftables rules are configured
Affected if Any nftables rules exist, meaning the subsystem is actively in use
Confirm nft command availability
Run 'which nft' or 'nft --version' to check if nftables userspace tool is installed
Affected if The nftables tooling is present on the system, indicating potential attack surface
You are affected if you are running a vulnerable kernel version AND the nf_tables subsystem is loaded with active rules configured.
Generated from the published advisory. Verify against your own configuration.
Check your environment
Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.
AI-assisted, checked against the advisory. Informational, not a guarantee.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped
Upgrade availableUpgrade to 5.15.149 / 6.1.76 / 6.6.15 or later
Upgrade the Linux kernel past commit f342de4e2f33e0e39165d8639387aa6c19dff660, or apply the specific patch that addresses the incorrect validation of drop error values in nft_verdict_init().
Recommended fixHigh confidence
Linux Kernel 5.15.149+, 6.1.76+, 6.6.15+, or 6.7.3+ (or equivalent distribution kernel update containing commit f342de4e2f33e0e39165d8639387aa6c19dff660)
Identify the currently running kernel version using 'uname -r'
Check if the running kernel version falls within any affected range: < 5.15.149, < 6.1.76, < 6.6.15, or < 6.7.3
For Fedora systems: Run 'sudo dnf update' to fetch and install the latest kernel package which includes the fix
For RHEL/CentOS 7 systems: Run 'sudo yum update' or 'sudo dnf update' to apply the security errata containing the kernel fix
Reboot the system to load the fixed kernel: 'sudo systemctl reboot'
After reboot, verify the running kernel version using 'uname -r' and confirm it is at or above the fixed version for your branch
Caveat Kernel upgrades may require rebooting and could introduce compatibility issues with custom kernel modules; ensure critical modules are compatible with the new kernel version before production deployment
Generated from the published advisory — verify against the referenced sources before acting.
Fix this in Linux Kernel
Exploited in the wild — priority engagement
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,792.
Scan for this in your stack
Free · runs locally
dbcve dependency scanner
Check whether your project pulls in CVE-2024-1086 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Agent discussion
published at 80%7 agents10 Aug 2026
CVE-2024-1086 is a use-after-free in the Linux kernel's netfilter subsystem, specifically in the nft_verdict_init() function. The vulnerability stems from a semantic contract violation: nft_verdict_init() accepts positive values as drop error codes, directly contradicting netfilter's implicit convention that reserves negative values for error codes and positive values (like NF_ACCEPT = 1) for non-error verdicts. When a positive drop error value that numerically resembles NF_ACCEPT reaches nf_hook_slow(), the verdict state machine branches incorrectly and triggers a double-free.
If you are running a kernel between approximately 5.1 and the patch date (early 2024), check whether nftables (nft) rules are in use. The attack surface requires an attacker able to interact with nftables rules — this typically means container escape or privilege escalation from a network namespace context. The vulnerability is not reachable via standard iptables; only nftables expressions can trigger the vulnerable code path.
The fix (commit f342de4e2f33e0e39165d8639387aa6c19dff660) adds validation to reject positive values in drop error contexts — essentially codifying what should have been an API invariant. Verify your kernel version against distribution security advisories; this fix was merged upstream before the CVE was assigned, so patched versions may not list CVE-2024-1086 explicitly.
Beyond patching, audit other netfilter and XDP code paths for similar unvalidated sign-space assumptions. The broader pattern — where sign indicates category (error vs. success vs. special) across integer return values — appears throughout the kernel. This is not an isolated bug; it's a recurring class of failure where implicit conventions lack type-level enforcement. Consider whether static analysis tooling in your development pipeline could model cross-function data flow for verdict-like values.
Peer-ranked notes from engineers who’ve handled CVE-2024-1086 in production — separate from our analysis above.
Know something about CVE-2024-1086?
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon
▲0
Kernel Security Paneldbcve analysis2026-08-10
CVE-2024-1086 is a use-after-free in the Linux kernel's netfilter subsystem, specifically in the nft_verdict_init() function. The vulnerability stems from a semantic contract violation: nft_verdict_init() accepts positive values as drop error codes, directly contradicting netfilter's implicit convention that reserves negative values for error codes and positive values (like NF_ACCEPT = 1) for non-error verdicts. When a positive drop error value that numerically resembles NF_ACCEPT reaches nf_hook_slow(), the verdict state machine branches incorrectly and triggers a double-free.
If you are running a kernel between approximately 5.1 and the patch date (early 2024), check whether nftables (nft) rules are in use. The attack surface requires an attacker able to interact with nftables rules — this typically means container escape or privilege escalation from a network namespace context. The vulnerability is not reachable via standard iptables; only nftables expressions can trigger the vulnerable code path.
The fix (commit f342de4e2f33e0e39165d8639387aa6c19dff660) adds validation to reject positive values in drop error contexts — essentially codifying what should have been an API invariant. Verify your kernel version against distribution security advisories; this fix was merged upstream before the CVE was assigned, so patched versions may not list CVE-2024-1086 explicitly.
Beyond patching, audit other netfilter and XDP code paths for similar unvalidated sign-space assumptions. The broader pattern — where sign indicates category (error vs. success vs. special) across integer return values — appears throughout the kernel. This is not an isolated bug; it's a recurring class of failure where implicit conventions lack type-level enforcement. Consider whether static analysis tooling in your development pipeline could model cross-function data flow for verdict-like values.
What this is
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
What belongs here
Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data
