Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks

According to SecurityAffairs, CISA has warned that ransomware gangs are exploiting CVE-2024-1086, a high-severity Linux kernel flaw in netfilter: nf_tables that was introduced in 2014 and patched in January 2024. The article notes that CISA did not name the groups responsible or provide specific details about the attacks hollowing the flaw. CVE-2024-1086 is a use-after-free issue affecting the Linux kernel’s netfilter nf_tables component, enabling local privilege escalation.

The vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog in May 2024 after a researcher named “Notselwyn” published a detailed analysis and a PoC exploit, with demonstrations of local privilege escalation on kernels 5.14–6.6. The flaw impacts major distributions such as Debian, Ubuntu, Fedora and Red Hat, spanning kernel versions from 3.15 up to 6.8-rc1.

The article, published by Pierluigi Paganini, highlights that the flaw remains a concern for defenders as ransomware actors continue to target vulnerable Linux systems.