Linux Kernel nf_tables Double-Free Local Privilege Escalation (CVE-2024-1086)

CVE-2024-1086 is a use-after-free/double-free flaw in the Linux kernel netfilter nf_tables subsystem. A local user can escalate to root on unpatched kernels. Exploit code has appeared in public repositories and penetration-testing toolchains.

Affected kernels

Linux kernel versions from approximately v5.14 through v6.6 before vendor backports (check your distro security advisory). Containers sharing the host kernel are also affected if the host is vulnerable.

Verify patch level

uname -r
cat /proc/version
rpm -q kernel 2>/dev/null | tail -1
apt list --installed 2>/dev/null | grep linux-image | tail -3

Remediation

• Apply the latest kernel security update from RHEL, Ubuntu, Debian, or SUSE
• Reboot after kernel update
• Limit local shell access on multi-tenant systems
• Watch for unexpected modprobe / nft activity in audit logs

Type: Local privilege escalation. Not remotely exploitable by itself, but dangerous after any foothold (web shell, stolen SSH key, container escape).