CVE-2024-1086

HIGH KEV RANSOMWARE LAB

Linux Kernel 3.15-5.15.149 - Use-After-Free in nf_tables Component

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-1086 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 30, 2024, with confirmed use in ransomware campaigns. EIP tracks 17 public exploits from researchers including Notselwyn, LLfam, kevcooper.

AI-analyzed exploit summary This repository contains a functional local privilege escalation (LPE) exploit for CVE-2024-1086, targeting Linux kernels between v5.14 and v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges with a high success rate (99.4% in KernelCTF environments).

Description

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

Exploits (17)

nomisec WORKING POC 2,433 stars
by Notselwyn · poc
https://github.com/Notselwyn/CVE-2024-1086

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2024-1086, targeting Linux kernels between v5.14 and v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges with a high success rate (99.4% in KernelCTF environments).

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (v5.14 to v6.6, excluding patched branches)
No auth needed
Prerequisites: User namespaces enabled (CONFIG_USER_NS=y) · Unprivileged user namespaces (kernel.unprivileged_userns_clone=1) · nf_tables enabled (CONFIG_NF_TABLES=y) · x64/amd64 architecture
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 21 stars
by LLfam · local
https://github.com/LLfam/CVE-2024-1086

This repository contains a functional exploit for CVE-2024-1086, a Linux kernel vulnerability in nftables that allows local privilege escalation (LPE) via a double-free in the netfilter subsystem. The exploit leverages namespace isolation, memory spraying, and a double-free to corrupt kernel memory and overwrite modprobe_path, achieving root access.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel 6.3.0 (with specific config)
No auth needed
Prerequisites: Linux kernel 6.3.0 with specific Kconfig options · User namespace and network namespace permissions · libnftnl and libmnl libraries
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 2 stars
by kevcooper · poc
https://github.com/kevcooper/CVE-2024-1086-checker

This repository contains a Python script that checks for kernel configurations vulnerable to CVE-2024-1086, a local privilege escalation vulnerability in the Linux kernel. It verifies kernel version, configuration settings, and module status to determine exploitability.

Classification
Scanner 100%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Linux kernel versions 3.15 to 6.8.0 (specific ranges)
No auth needed
Prerequisites: Local access to the target system · Ability to read /proc and /boot files
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by Alicey0719 · poc
https://github.com/Alicey0719/docker-POC_CVE-2024-1086

This repository provides a Dockerized environment to test CVE-2024-1086, a local privilege escalation vulnerability. It clones and compiles an exploit from Notselwyn's repository, demonstrating successful privilege escalation to root.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (specific versions affected by CVE-2024-1086)
No auth needed
Prerequisites: Linux system with vulnerable kernel · ability to compile and run the exploit
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →
github WRITEUP
by eavil666 · pythonpoc
https://github.com/eavil666/cve-poc-mapper/tree/main/content/cve/CVE-2024-1086.md

This repository provides a technical writeup of CVE-2024-1086, a use-after-free vulnerability in the Linux kernel's netfilter nf_tables component that allows local privilege escalation (LPE). It includes references to official patches and links to external PoC repositories but does not contain exploit code itself.

Classification
Writeup 98%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (netfilter nf_tables component)
Auth required
Prerequisites: Local user access · Vulnerable Linux kernel version with nf_tables enabled
mistral-large-3 · analyzed Jul 24, 2026 Full analysis →
nomisec SCANNER
by JHarv613 · poc
https://github.com/JHarv613/CVE_2024_1086_vulnerability_check

This script scans remote hosts via SSH to check if their kernel versions fall within the vulnerable ranges for CVE-2024-1086. It does not exploit the vulnerability but detects potential exposure based on version comparison.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Linux Kernel (specific versions)
Auth required
Prerequisites: SSH access with key-based authentication · list of target IPs/hostnames in vuln_ip.txt
mistral-large-3 · analyzed Jun 30, 2026 Full analysis →
github WRITEUP
by Luisbuilds-data · poc
https://github.com/Luisbuilds-data/cve-2024-1086-writeup

This repository provides a detailed technical analysis of CVE-2024-1086, focusing on the root cause in the Linux kernel's netfilter subsystem. It explains the logic confusion in `nft_verdict_init` leading to a double-free vulnerability and outlines the exploitation strategy involving heap spray to achieve arbitrary memory write and privilege escalation.

Classification
Writeup 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Theoretical
Target: Linux kernel < 6.8 (netfilter nf_tables)
No auth needed
Prerequisites: Ability to craft nf_tables rules · Kernel heap spray technique
mistral-large-3 · analyzed Jun 22, 2026 Full analysis →
nomisec WORKING POC
by b1nhack · local
https://github.com/b1nhack/CVE-2024-1086

This repository contains a functional exploit for CVE-2024-1086, a Linux kernel vulnerability involving a double-free in the nftables subsystem. The exploit leverages netfilter rules and crafted IP packets to trigger memory corruption, leading to privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (nftables subsystem)
No auth needed
Prerequisites: Linux kernel with nftables support · CAP_NET_ADMIN capabilities
mistral-large-3 · analyzed May 31, 2026 Full analysis →
gitlab WORKING POC
by FarrimWildaxe · poc
https://gitlab.com/FarrimWildaxe/CVE-2024-1086

This repository contains a functional exploit for CVE-2024-1086, a Linux kernel vulnerability involving a double-free in the netfilter subsystem. The exploit leverages crafted nftables rules and network packets to trigger memory corruption, leading to privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (netfilter/nftables)
No auth needed
Prerequisites: Linux kernel with vulnerable netfilter/nftables implementation · CAP_NET_ADMIN capabilities to configure nftables
mistral-large-3 · analyzed May 25, 2026 Full analysis →
nomisec WORKING POC
by vettrivel007 · local
https://github.com/vettrivel007/CVE-2024-1086

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2024-1086, targeting Linux kernels v5.14 to v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges with a high success rate (99.4% in KernelCTF environments).

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (v5.14 to v6.6, excluding patched versions)
No auth needed
Prerequisites: user namespaces enabled (CONFIG_USER_NS=y) · unprivileged user namespaces (kernel.unprivileged_userns_clone=1) · nf_tables enabled (CONFIG_NF_TABLES=y) · x64/amd64 architecture
mistral-large-3 · analyzed Apr 10, 2026 Full analysis →
nomisec WRITEUP
by sandesh9978 · poc
https://github.com/sandesh9978/cve-2024-1086-lpe

This repository provides a detailed technical analysis and proof-of-concept for CVE-2024-1086, a Linux kernel nf_tables use-after-free vulnerability leading to local privilege escalation. It includes vulnerability breakdown, affected versions, exploitation methodology, and mitigation guidance.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (nf_tables)
No auth needed
Prerequisites: Local access to a vulnerable Linux kernel version
mistral-large-3 · analyzed Mar 04, 2026 Full analysis →
nomisec WORKING POC
by ndt2111200203 · local
https://github.com/ndt2111200203/CVE-2024-1086

This repository contains a functional exploit for CVE-2024-1086, a Linux kernel vulnerability. The exploit is written in C and includes custom headers and libraries for compatibility, targeting the nftables subsystem.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (nftables subsystem)
No auth needed
Prerequisites: Linux kernel with vulnerable nftables implementation · Compilation environment with musl-gcc
mistral-large-3 · analyzed Feb 19, 2026 Full analysis →
nomisec STUB
by karim4353 · local
https://github.com/karim4353/CVE-2024-1086-Exploit

This repository is a non-functional educational template for CVE-2024-1086, a use-after-free vulnerability in the Linux kernel's `nf_tables` component. It includes placeholder code in C and Java, designed for controlled lab environments, with no actual exploit functionality.

Classification
Stub 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Theoretical
Target: Linux kernel (5.14 to 6.6, unpatched)
No auth needed
Prerequisites: Vulnerable Linux kernel (5.14 to 6.6, unpatched) · Lab environment (e.g., VM)
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by xzx482 · local
https://github.com/xzx482/CVE-2024-1086

This repository contains a functional local privilege escalation exploit for CVE-2024-1086, targeting Linux kernels between v5.14 and v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (v5.14 to v6.6)
No auth needed
Prerequisites: User namespaces enabled · Unprivileged user namespace cloning allowed · nf_tables module loaded
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by feely666 · poc
https://github.com/feely666/CVE-2024-1086

The repository contains only a README.md file with minimal content (just the CVE identifier) and no exploit code or technical details.

Classification
Stub 100%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by CCIEVoice2009 · local
https://github.com/CCIEVoice2009/CVE-2024-1086

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2024-1086, targeting Linux kernels between v5.14 and v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges, with a high success rate in controlled environments.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (v5.14 to v6.6)
No auth needed
Prerequisites: User namespaces enabled (CONFIG_USER_NS=y) · Unprivileged user namespaces (kernel.unprivileged_userns_clone=1) · nf_tables enabled (CONFIG_NF_TABLES=y) · x64/amd64 architecture
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →

Scores

CVSS v3 7.8
EPSS 0.2806
EPSS Percentile 97.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2024-05-30
VulnCheck KEV 2024-05-30
InTheWild.io 2024-05-30
ENISA EUVD EUVD-2024-16861
Ransomware Use Confirmed
CWE
CWE-416
Status published
Products (13)
debian/debian_linux 10.0
fedoraproject/fedora 39
linux/linux_kernel 6.8 rc1
linux/linux_kernel 3.15 - 5.15.149
netapp/500f_firmware
netapp/a250_firmware
netapp/c250_firmware
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_for_ibm_z_systems 7.0_s390x
redhat/enterprise_linux_for_power_big_endian 7.0_ppc64
... and 3 more
Published Jan 31, 2024
KEV Added May 30, 2024
Tracked Since Feb 18, 2026