Security readout for executives and security teams
Plain-English summary
CVE-2024-1086 is a Linux kernel flaw that can let a logged-in attacker become root. It affects the netfilter nf_tables subsystem. CISA lists it as known exploited, so organizations should treat vulnerable Linux systems as a near-term remediation priority, especially shared servers, internet-facing hosts, and container platforms where local code execution may be possible.
Executive priority
High priority. Because CISA lists known exploitation and the bug can grant root access, patching should be tracked as an urgent infrastructure risk, not a routine kernel update. Prioritize shared Linux systems and externally exposed services that could lead to local code execution.
Technical view
The issue is a use-after-free/double-free condition in netfilter nf_tables verdict handling. nft_verdict_init() permits positive drop error values, and nf_hook_slow() can mis-handle an NF_DROP verdict resembling NF_ACCEPT. The CVE record recommends upgrading past Linux commit f342de4e2f33e0e39165d8639387aa6c19dff660.
Likely exposure
Exposure is most relevant to Linux systems running vulnerable kernels with nf_tables/netfilter available. The source bundle identifies Linux Kernel and references Fedora, Debian LTS, and NetApp advisories. Exact exposure depends on distribution backports and vendor kernel packaging, so version checks must be vendor-specific.
Exploitation context
This is local privilege escalation: an attacker needs local, low-privileged access and no user interaction. CISA KEV supports active exploitation. Public exploit research and a public GitHub repository are referenced, increasing operational risk, but this assessment does not rely on or provide exploitation steps.
Researcher notes
The public record supports a local LPE in Linux nf_tables with CVSS 7.8 and CWE-416. The source bundle’s affected-version detail is limited, so rely on distribution advisories and kernel patch provenance rather than a single upstream version string.
Mitigation direction
- Prioritize Linux kernel updates from your distribution or vendor.
- Verify the fix includes or backports commit f342de4e2f33e0e39165d8639387aa6c19dff660.
- Review Fedora, Debian LTS, NetApp, and other vendor advisories for affected products.
- Restrict untrusted local shell access until patched where feasible.
- Apply compensating controls for shared hosts and container platforms pending vendor fixes.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and container hosts.
- Confirm vendor advisories mark installed kernel packages as fixed.
- Check whether the patch commit is present or backported by the vendor.
- Prioritize systems where untrusted users or workloads can execute local code.
- Document exceptions where vendor guidance states the platform is unaffected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-1086 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9GoogleVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2024-1086 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2024-05-30T00:00:00.000Z: CVE-2024-1086 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660CVE reference, Google · patch
- https://kernel.dance/f342de4e2f33e0e39165d8639387aa6c19dff660CVE reference, Google
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LSPIOMIJYTLZB6QKPQVVAYSUETUWKPF/CVE reference, Google
- https://github.com/Notselwyn/CVE-2024-1086CVE reference, Google
- https://news.ycombinator.com/item?id=39828424CVE reference, Google
- https://pwning.tech/nftables/CVE reference, Google
- https://security.netapp.com/advisory/ntap-20240614-0009/CVE reference, Google
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.htmlCVE reference, Google
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, Google
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1086CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.