CVE-2024-1086

HIGH KEV RANSOMWARE LAB

Linux Kernel 3.15-5.15.149 - Use-After-Free in nf_tables Component

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-1086 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 30, 2024, with confirmed use in ransomware campaigns. EIP tracks 14 public exploits from researchers including Notselwyn, LLfam, kevcooper.

AI-analyzed exploit summary This repository contains a functional local privilege escalation (LPE) exploit for CVE-2024-1086, targeting Linux kernels between v5.14 and v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges with a high success rate (99.4% in KernelCTF environments).

Description

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

Exploits (14)

nomisec WORKING POC 2,433 stars
by Notselwyn · poc
https://github.com/Notselwyn/CVE-2024-1086

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2024-1086, targeting Linux kernels between v5.14 and v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges with a high success rate (99.4% in KernelCTF environments).

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (v5.14 to v6.6, excluding patched branches)
No auth needed
Prerequisites: User namespaces enabled (CONFIG_USER_NS=y) · Unprivileged user namespaces (kernel.unprivileged_userns_clone=1) · nf_tables enabled (CONFIG_NF_TABLES=y) · x64/amd64 architecture
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 21 stars
by LLfam · local
https://github.com/LLfam/CVE-2024-1086

This repository contains a functional exploit for CVE-2024-1086, a Linux kernel vulnerability in nftables that allows local privilege escalation (LPE) via a double-free in the netfilter subsystem. The exploit leverages namespace isolation, memory spraying, and a double-free to corrupt kernel memory and overwrite modprobe_path, achieving root access.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel 6.3.0 (with specific config)
No auth needed
Prerequisites: Linux kernel 6.3.0 with specific Kconfig options · User namespace and network namespace permissions · libnftnl and libmnl libraries
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER 2 stars
by kevcooper · poc
https://github.com/kevcooper/CVE-2024-1086-checker

This repository contains a Python script that checks for kernel configurations vulnerable to CVE-2024-1086, a local privilege escalation vulnerability in the Linux kernel. It verifies kernel version, configuration settings, and module status to determine exploitability.

Classification
Scanner 100%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Linux kernel versions 3.15 to 6.8.0 (specific ranges)
No auth needed
Prerequisites: Local access to the target system · Ability to read /proc and /boot files
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by Alicey0719 · poc
https://github.com/Alicey0719/docker-POC_CVE-2024-1086

This repository provides a Dockerized environment to test CVE-2024-1086, a local privilege escalation vulnerability. It clones and compiles an exploit from Notselwyn's repository, demonstrating successful privilege escalation to root.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (specific versions affected by CVE-2024-1086)
No auth needed
Prerequisites: Linux system with vulnerable kernel · ability to compile and run the exploit
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by b1nhack · local
https://github.com/b1nhack/CVE-2024-1086

This repository contains a functional exploit for CVE-2024-1086, a Linux kernel vulnerability involving a double-free in the nftables subsystem. The exploit leverages netfilter rules and crafted IP packets to trigger memory corruption, leading to privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (nftables subsystem)
No auth needed
Prerequisites: Linux kernel with nftables support · CAP_NET_ADMIN capabilities
devstral-2 · analyzed May 31, 2026 Full analysis →
gitlab WORKING POC
by FarrimWildaxe · poc
https://gitlab.com/FarrimWildaxe/CVE-2024-1086

This repository contains a functional exploit for CVE-2024-1086, a Linux kernel vulnerability involving a double-free in the netfilter subsystem. The exploit leverages crafted nftables rules and network packets to trigger memory corruption, leading to privilege escalation.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (netfilter/nftables)
No auth needed
Prerequisites: Linux kernel with vulnerable netfilter/nftables implementation · CAP_NET_ADMIN capabilities to configure nftables
devstral-2 · analyzed May 25, 2026 Full analysis →
nomisec WORKING POC
by vettrivel007 · local
https://github.com/vettrivel007/CVE-2024-1086

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2024-1086, targeting Linux kernels v5.14 to v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges with a high success rate (99.4% in KernelCTF environments).

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (v5.14 to v6.6, excluding patched versions)
No auth needed
Prerequisites: user namespaces enabled (CONFIG_USER_NS=y) · unprivileged user namespaces (kernel.unprivileged_userns_clone=1) · nf_tables enabled (CONFIG_NF_TABLES=y) · x64/amd64 architecture
devstral-2 · analyzed Apr 10, 2026 Full analysis →
nomisec WRITEUP
by sandesh9978 · poc
https://github.com/sandesh9978/cve-2024-1086-lpe

This repository provides a detailed technical analysis and proof-of-concept for CVE-2024-1086, a Linux kernel nf_tables use-after-free vulnerability leading to local privilege escalation. It includes vulnerability breakdown, affected versions, exploitation methodology, and mitigation guidance.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux Kernel (nf_tables)
No auth needed
Prerequisites: Local access to a vulnerable Linux kernel version
devstral-2 · analyzed Mar 04, 2026 Full analysis →
nomisec WORKING POC
by ndt2111200203 · local
https://github.com/ndt2111200203/CVE-2024-1086

This repository contains a functional exploit for CVE-2024-1086, a Linux kernel vulnerability. The exploit is written in C and includes custom headers and libraries for compatibility, targeting the nftables subsystem.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (nftables subsystem)
No auth needed
Prerequisites: Linux kernel with vulnerable nftables implementation · Compilation environment with musl-gcc
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec STUB
by karim4353 · local
https://github.com/karim4353/CVE-2024-1086-Exploit

This repository is a non-functional educational template for CVE-2024-1086, a use-after-free vulnerability in the Linux kernel's `nf_tables` component. It includes placeholder code in C and Java, designed for controlled lab environments, with no actual exploit functionality.

Classification
Stub 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Theoretical
Target: Linux kernel (5.14 to 6.6, unpatched)
No auth needed
Prerequisites: Vulnerable Linux kernel (5.14 to 6.6, unpatched) · Lab environment (e.g., VM)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by xzx482 · local
https://github.com/xzx482/CVE-2024-1086

This repository contains a functional local privilege escalation exploit for CVE-2024-1086, targeting Linux kernels between v5.14 and v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (v5.14 to v6.6)
No auth needed
Prerequisites: User namespaces enabled · Unprivileged user namespace cloning allowed · nf_tables module loaded
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by feely666 · poc
https://github.com/feely666/CVE-2024-1086

The repository contains only a README.md file with minimal content (just the CVE identifier) and no exploit code or technical details.

Classification
Stub 100%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by CCIEVoice2009 · local
https://github.com/CCIEVoice2009/CVE-2024-1086

This repository contains a functional local privilege escalation (LPE) exploit for CVE-2024-1086, targeting Linux kernels between v5.14 and v6.6. The exploit leverages a use-after-free vulnerability in the nf_tables subsystem to achieve root privileges, with a high success rate in controlled environments.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (v5.14 to v6.6)
No auth needed
Prerequisites: User namespaces enabled (CONFIG_USER_NS=y) · Unprivileged user namespaces (kernel.unprivileged_userns_clone=1) · nf_tables enabled (CONFIG_NF_TABLES=y) · x64/amd64 architecture
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Scores

CVSS v3 7.8
EPSS 0.8455
EPSS Percentile 99.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2024-05-30
VulnCheck KEV 2024-05-30
InTheWild.io 2024-05-30
ENISA EUVD EUVD-2024-16861
Ransomware Use Confirmed
CWE
CWE-416
Status published
Products (13)
debian/debian_linux 10.0
fedoraproject/fedora 39
linux/linux_kernel 6.8 rc1
linux/linux_kernel 3.15 - 5.15.149
netapp/500f_firmware
netapp/a250_firmware
netapp/c250_firmware
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_for_ibm_z_systems 7.0_s390x
redhat/enterprise_linux_for_power_big_endian 7.0_ppc64
... and 3 more
Published Jan 31, 2024
KEV Added May 30, 2024
Tracked Since Feb 18, 2026