Security / CVE-2024-1086

Linux kernel nf_tables use-after-free

A use-after-free in the Linux kernel netfilter nf_tables component can cause a double free and allow local privilege escalation. CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog.

CVSS ratings

CVSS v3.1 · 7.8 · High

Abora Team Priority

Abora priority not assigned

Abora OS assessment

Stable channel

Abora release assessment

Not Affected

Edge channel

Abora prerelease assessment

Not Affected

Affected components

Linux kernel
netfilter nf_tables

NVD records the upstream affected ranges and fix commit. Ubuntu's current record marks its supported 24.04-and-newer kernel packages not affected; distribution package states do not establish Abora exposure.

Version ranges and Abora release impact

Upstream Linux versions affected: NVD lists affected upstream versions from 3.15 up to (but not including) 5.15.149; 6.1 up to 6.1.76; 6.2 up to 6.6.15; 6.7 up to 6.7.3; and 6.8-rc1.
Upstream versions with fixes: Fixes are included in 5.15.149, 6.1.76, 6.6.15, and 6.7.3; the 6.8 release line includes the fix. Downstream distributions may backport the patch to older-looking package versions.

Affected status and recommended action for each Abora release for CVE-2024-1086
Abora release	Release date	Linux kernel	CVE-2024-1086 status	What to do
v4.2 Solstice	In development	TBD	Cannot assess The release kernel is not specified.	Confirm the final kernel version, then reassess this CVE.
v4.1 Horizon	October 3, 2026	Linux 7.2.9	Not affected This kernel is newer than the published upstream affected range.	No update is indicated for this CVE by the listed upstream version range.
v4.0 Everest (2026.08.28)	August 29, 2026	Linux 7.2	Not affected This kernel is newer than the published upstream affected range.	No update is indicated for this CVE by the listed upstream version range.
2026.07.27 Alpha	July 27, 2026	Linux 7.x	Not affected This kernel is newer than the published upstream affected range.	No update is indicated for this CVE by the listed upstream version range.
v3 Denali (v3.14)	June 2026	Linux 7.0 / 7.1	Not affected This kernel is newer than the published upstream affected range.	No update is indicated for this CVE by the listed upstream version range.
v2.5.0 / v2	May / June 2026	Linux 7.0	Not affected This kernel is newer than the published upstream affected range.	No update is indicated for this CVE by the listed upstream version range.
v1.0.1 / v1	March 26, 2026	Linux 6.19 / 7.0	Not affected This kernel is newer than the published upstream affected range.	No update is indicated for this CVE by the listed upstream version range.
v36 (First Beta)	March 17, 2026	Linux 6.19	Not affected This kernel is newer than the published upstream affected range.	No update is indicated for this CVE by the listed upstream version range.

Affected status is based on the upstream kernel version and branch fix. An Abora vendor backport can change package-level exposure; verify the shipped kernel package.