{"answers":{"affected":"It affects 18 products.","exploited":"Yes. Attackers have exploited CVE-2024-1086 in the wild since at least 30 May 2024, including in ransomware campaigns.","fix":"Apply the vendor's patch. US federal agencies must fix it by 20 Jun 2024.","what":"CVE-2024-1086 is a high-severity use after free vulnerability in Debian Debian Linux, published on 31 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-1086 and fix it if it is affected.\n\nWhat it is: CVE-2024-1086 is a high-severity use after free vulnerability in Debian Debian Linux, published on 31 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: Yes. Attackers have exploited CVE-2024-1086 in the wild since at least 30 May 2024, including in ransomware campaigns.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-1086/ (Markdown: https://insights.sbomify.com/CVE-2024-1086/index.md)","id":"CVE-2024-1086","markdown":"https://insights.sbomify.com/CVE-2024-1086/index.md","name":"CVE-2024-1086","record":{"aliases":["AZL-34155","AZL-34874","BELL-CVE-2024-1086","CLSA-2025-1744372501","DEBIAN-CVE-2024-1086","GHSA-gfh2-2mj9-m2cx","RHSA-2024:3318","RHSA-2024:3427","RHSA-2024:3805","RHSA-2024:4073","RHSA-2024:4074","RHSA-2024:4075","SUSE-SU-2024:1373-1","SUSE-SU-2024:1401-1","UBUNTU-CVE-2024-1086"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel netfilter component allows local attackers to escalate privileges.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Google","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"fedora","vendor":"fedoraproject"},{"product":"linux_kernel","vendor":"linux"},{"product":"500f_firmware","vendor":"netapp"},{"product":"a250_firmware","vendor":"netapp"},{"product":"bootstrap_os","vendor":"netapp"},{"product":"c250_firmware","vendor":"netapp"},{"product":"h300s_firmware","vendor":"netapp"},{"product":"h410c_firmware","vendor":"netapp"},{"product":"h410s_firmware","vendor":"netapp"},{"product":"h500s_firmware","vendor":"netapp"},{"product":"h700s_firmware","vendor":"netapp"},{"product":"enterprise_linux_desktop","vendor":"redhat"},{"product":"enterprise_linux_for_ibm_z_systems","vendor":"redhat"},{"product":"enterprise_linux_for_power_big_endian","vendor":"redhat"},{"product":"enterprise_linux_for_power_little_endian","vendor":"redhat"},{"product":"enterprise_linux_server","vendor":"redhat"},{"product":"enterprise_linux_workstation","vendor":"redhat"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.\n\nThe nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.\n\nWe recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.","ecosystems":["Red Hat:enterprise_linux:7::server","Red Hat:rhel_aus:7.6::server","Red Hat:rhel_e4s:8.4::baseos","Red Hat:rhel_e4s:8.6::baseos","Red Hat:rhel_eus:9.0::baseos","Red Hat:rhel_eus:9.2::baseos","SUSE:Linux Enterprise Live Patching 12 SP5"],"exploits":{"exploitdb":0,"first_seen":"2024-03-20","github_poc":17,"max_poc_stars":2458,"metasploit":0,"nuclei":0,"refs":[{"date":"2024-03-20T21:16:41Z","kind":"github_poc","ref":"https://github.com/Notselwyn/CVE-2024-1086","stars":2458,"title":"Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images."},{"date":"2024-12-16T17:33:13Z","kind":"github_poc","ref":"https://github.com/LLfam/CVE-2024-1086","stars":23,"title":null},{"date":"2024-04-03T13:09:22Z","kind":"github_poc","ref":"https://github.com/Alicey0719/docker-POC_CVE-2024-1086","stars":3,"title":null},{"date":"2024-06-03T22:04:03Z","kind":"github_poc","ref":"https://github.com/kevcooper/CVE-2024-1086-checker","stars":2,"title":null},{"date":"2026-03-04T04:54:06Z","kind":"github_poc","ref":"https://github.com/sandesh9978/cve-2024-1086-lpe","stars":1,"title":"Technical analysis and proof-of-concept for CVE-2024-1086, a Linux kernel nf_tables use-after-free vulnerability leading to local privilege escalation. Includes vulnerability breakdown, affected versions, exploitation methodology, and mitigation guidance for research and educational purposes."},{"date":"2026-08-06T23:11:19Z","kind":"github_poc","ref":"https://github.com/dopaminauta/onetwoseven-writeup","stars":1,"title":"HTB OneTwoSeven full walkthrough: deterministic creds, chroot symlink escape, rewrite-rule bypass RCE, CVE-2024-1086 to root"},{"date":"2024-04-30T16:10:37Z","kind":"github_poc","ref":"https://github.com/CCIEVoice2009/CVE-2024-1086","stars":0,"title":null},{"date":"2024-06-10T15:19:39Z","kind":"github_poc","ref":"https://github.com/feely666/CVE-2024-1086","stars":0,"title":null}],"tier":"exploited"},"has_fix":true,"headline":"Linux Kernel Use-After-Free","id":"CVE-2024-1086","indexable":true,"kev":{"dateAdded":"2024-05-30","dueDate":"2024-06-20","knownRansomwareCampaignUse":"Known","product":"Kernel","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","vendorProject":"Linux","vulnerabilityName":"Linux Kernel Use-After-Free Vulnerability"},"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux","fedoraproject:fedora","linux:linux_kernel","netapp:bootstrap_os","netapp:h300s_firmware","netapp:h410c_firmware","netapp:h410s_firmware","netapp:h500s_firmware","netapp:h700s_firmware","redhat:enterprise_linux_desktop","redhat:enterprise_linux_for_ibm_z_systems","redhat:enterprise_linux_for_power_little_endian","redhat:enterprise_linux_server","redhat:enterprise_linux_workstation"],"type":"use_after_free","year":"2024"},"n_packages":54,"n_references":14,"next":{"headline":"Password Protected Store for WooCommerce \u003c= 2.2 - Information Exposure via REST API","id":"CVE-2024-1088"},"packages":[{"ecosystem":"Red Hat:enterprise_linux:7::server","fixed":["0:1-4.el7"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-3_10_0-1160_105_1","purl":"pkg:rpm/redhat/kpatch-patch-3_10_0-1160_105_1","source":"RHSA-2024:4073"},{"ecosystem":"Red Hat:enterprise_linux:7::server","fixed":["0:1-4.el7"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-3_10_0-1160_105_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-3_10_0-1160_105_1-debuginfo","source":"RHSA-2024:4073"},{"ecosystem":"Red Hat:enterprise_linux:7::server","fixed":["0:1-3.el7"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-3_10_0-1160_108_1","purl":"pkg:rpm/redhat/kpatch-patch-3_10_0-1160_108_1","source":"RHSA-2024:4073"},{"ecosystem":"Red Hat:enterprise_linux:7::server","fixed":["0:1-3.el7"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-3_10_0-1160_108_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-3_10_0-1160_108_1-debuginfo","source":"RHSA-2024:4073"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"bpftool","purl":"pkg:rpm/redhat/bpftool","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel","purl":"pkg:rpm/redhat/kernel","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-abi-whitelists","purl":"pkg:rpm/redhat/kernel-abi-whitelists","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-debug","purl":"pkg:rpm/redhat/kernel-debug","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-debug-debuginfo","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel","purl":"pkg:rpm/redhat/kernel-debug-devel","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo","purl":"pkg:rpm/redhat/kernel-debuginfo","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-x86_64","purl":"pkg:rpm/redhat/kernel-debuginfo-common-x86_64","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-devel","purl":"pkg:rpm/redhat/kernel-devel","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-doc","purl":"pkg:rpm/redhat/kernel-doc","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-tools","purl":"pkg:rpm/redhat/kernel-tools","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-tools-debuginfo","purl":"pkg:rpm/redhat/kernel-tools-debuginfo","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-tools-libs","purl":"pkg:rpm/redhat/kernel-tools-libs","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"kernel-tools-libs-devel","purl":"pkg:rpm/redhat/kernel-tools-libs-devel","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"perf","purl":"pkg:rpm/redhat/perf","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"perf-debuginfo","purl":"pkg:rpm/redhat/perf-debuginfo","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"python-perf","purl":"pkg:rpm/redhat/python-perf","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_aus:7.6::server","fixed":["0:3.10.0-957.113.1.el7"],"introduced":["0"],"last_affected":[],"package":"python-perf-debuginfo","purl":"pkg:rpm/redhat/python-perf-debuginfo","source":"RHSA-2024:3318"},{"ecosystem":"Red Hat:rhel_e4s:8.4::baseos","fixed":["0:1-3.el8_4"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-305_114_1","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-305_114_1","source":"RHSA-2024:3805"},{"ecosystem":"Red Hat:rhel_e4s:8.4::baseos","fixed":["0:1-3.el8_4"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-305_114_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-305_114_1-debuginfo","source":"RHSA-2024:3805"},{"ecosystem":"Red Hat:rhel_e4s:8.4::baseos","fixed":["0:1-3.el8_4"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-305_114_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-305_114_1-debugsource","source":"RHSA-2024:3805"},{"ecosystem":"Red Hat:rhel_e4s:8.4::baseos","fixed":["0:1-2.el8_4"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-305_120_1","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-305_120_1","source":"RHSA-2024:3805"},{"ecosystem":"Red Hat:rhel_e4s:8.4::baseos","fixed":["0:1-2.el8_4"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-305_120_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-305_120_1-debuginfo","source":"RHSA-2024:3805"},{"ecosystem":"Red Hat:rhel_e4s:8.4::baseos","fixed":["0:1-2.el8_4"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-305_120_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-305_120_1-debugsource","source":"RHSA-2024:3805"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-4.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_80_1","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_80_1","source":"RHSA-2024:4075"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-4.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_80_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_80_1-debuginfo","source":"RHSA-2024:4075"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-4.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_80_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_80_1-debugsource","source":"RHSA-2024:4075"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-3.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_87_1","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_87_1","source":"RHSA-2024:4075"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-3.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_87_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_87_1-debuginfo","source":"RHSA-2024:4075"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-3.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_87_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_87_1-debugsource","source":"RHSA-2024:4075"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-2.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_91_1","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_91_1","source":"RHSA-2024:4075"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-2.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_91_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_91_1-debuginfo","source":"RHSA-2024:4075"},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","fixed":["0:1-2.el8_6"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-4_18_0-372_91_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-4_18_0-372_91_1-debugsource","source":"RHSA-2024:4075"},{"ecosystem":"Red Hat:rhel_eus:9.0::baseos","fixed":["0:1-4.el9_0"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-70_80_1","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-70_80_1","source":"RHSA-2024:3427"},{"ecosystem":"Red Hat:rhel_eus:9.0::baseos","fixed":["0:1-4.el9_0"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-70_80_1-debuginfo","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-70_80_1-debuginfo","source":"RHSA-2024:3427"},{"ecosystem":"Red Hat:rhel_eus:9.0::baseos","fixed":["0:1-4.el9_0"],"introduced":["0"],"last_affected":[],"package":"kpatch-patch-5_14_0-70_80_1-debugsource","purl":"pkg:rpm/redhat/kpatch-patch-5_14_0-70_80_1-debugsource","source":"RHSA-2024:3427"}],"prev":{"headline":"Use-after-free in Linux kernel's netfilter: nf_tables component","id":"CVE-2024-1085"},"products":["Kernel"],"published":"2024-01-31","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-07","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel netfilter component allows local attackers to escalate privileges.","url":"https://insights.sbomify.com/CVE-2024-1086/"}