CVE Watch7 ago 2026

CVE-2024-1086

Linux Kernel Use-After-Free Vulnerability

CVSS

7.8

Alto

EPSS

28.1%

p98

KEV

SÍ

30 may 2024

Exploit Today

0-100

Publicado: 31 ene 2024 · Última mod.: 7 ago 2026 · CWE-416

EPSS · 30d

28.1%EPSS · 30 días28.1%

2026-09-172026-10-15

Ficha del catálogo KEV

Producto

Linux / Kernel

Vulnerabilidad

Linux Kernel Use-After-Free Vulnerability

Añadido a KEV

30 may 2024

Remediar antes de

20 jun 2024

Uso conocido en ransomware

Sí

Descripción resumida

Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.

Acción requerida

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660; https://nvd.nist.gov/vuln/detail/CVE-2024-1086

Descripción técnica

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-110922—

—

———Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)9h CVE-2026-110921—

—

———Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)9h CVE-2026-110919—

—

———Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)9h CVE-2026-1084468.8 ALT

—

———Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.10h CVE-2026-1084428.8 ALT

—

———Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.10h