Old Linux Kernel flaw CVE-2024-1086 resurfaces in ransomware attacks

CISA warns ransomware gangs are exploiting CVE-2024-1086, a Linux kernel use-after-free bug in netfilter: nf_tables that was introduced in 2014 and patched in January 2024. The vulnerability enables local privilege escalation and has been integrated into rootkits for kernel-level access. What's notable: this is a 10-year-old bug that lived quietly in production kernels until disclosure. Researcher Notselwyn published detailed analysis and PoC in March 2024, demonstrating reliable escalation on kernels 5.14–6.6 by avoiding fields that cause panics. CISA added to KEV catalog after public PoC release. The flaw affects major distributions—Debian, Ubuntu, Fedora, Red Hat—impacting kernel versions 3.15 through 6.8-rc1.

CVE-2024-1086: 10-Year-Old Linux Kernel Bug Now in Ransomware Toolchains

USN-7835-4: Linux kernel (HWE) vulnerabilities

Canonical issued USN-7835-4 addressing critical Linux kernel vulnerabilities affecting Ubuntu 22.04 LTS and hardware enablement (HWE) variants. The advisory resolves multiple privilege escalation and denial-of-service issues across networking and memory subsystems. What's interesting: includes fixes for CVE-2024-1086—the netfilter nf_tables use-after-free that CISA warned is now in ransomware toolchains. The update also addresses several memory management flaws discovered through fuzzing initiatives. Systems must be rebooted to apply kernel patches. Cloud and server instances with delayed patching windows face increased exploitation risk, particularly for the ransomware-exploited CVE-2024-1086.

📂 Linux

CVE-2024-1086: 10-Year-Old Linux Kernel Bug Now in Ransomware Toolchains

Ubuntu USN-7835-4 Patches Linux Kernel Including CVE-2024-1086