CASCACascade Atlas

Evidence dossier

CVE-2024-1086

Use-after-free in Linux kernel's netfilter: nf_tables component

Exploited in the wild (CISA KEV since May 30, 2024). NVD reports CVSS 3.1 7.8. EPSS estimates 28.1% exploit likelihood as of Aug 27, 2026.

70.1–82.1Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

State
PUBLISHED
Published
Jan 31, 2024
Updated
Oct 21, 2025
Evidence coverage
85%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    Google

    Record text: Use-after-free in Linux kernel's netfilter: nf_tables component

    Inspect raw assertion
    Field
    container
    Value
    Use-after-free in Linux kernel's netfilter: nf_tables component
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Linux Kernel Use-After-Free Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Linux Kernel Use-After-Free Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 28.06% probability · 97.96th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.280580000000; percentile 0.979590000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date May 30, 2024 · first observed Jul 19, 2026

Exploit likelihood28.06%

FIRST EPSS · score date Aug 27, 2026 · 98th percentile · first observed Aug 27, 2026

SeverityCVSS 7.8

NVD · CVSS 3.1 · first observed Aug 8, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Aug 27, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Aug 27, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
GoogleOriginal assertion
Record text

Use-after-free in Linux kernel's netfilter: nf_tables component

Inspect raw assertion
Field
container
Value
Use-after-free in Linux kernel's netfilter: nf_tables component
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

Linux Kernel Use-After-Free Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Linux Kernel Use-After-Free Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

28.06% probability · 97.96th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.280580000000; percentile 0.979590000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
19Underlying assertions
15Canonical products
16Target assertions
3Constraint assertions

Grouped from 10 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

17 scope groups

CISA-ADP · source assertedlinuxlinux_kernelDirect source scope
Affected: 3.15 to before 6.8 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "3.15", "lessThan": "6.8", "versionType": "custom"}]
Google · source assertedLinuxKernelDirect source scope
Affected: 3.15 to before 6.8 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "3.15", "lessThan": "6.8", "versionType": "custom"}]
NVD CPE · OPERATING SYSTEMdebiandebian_linuxVulnerable target · 1 assertions
Version 10.0Canonical identity product-3ccb4bc87dfae98fa2f2a06435fe5b3d9be78572fb958a89f2d7a96b4066447eLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    3 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    07b237a9-69a3-4a9c-9da0-4e06bd37ae73
NVD CPE · OPERATING SYSTEMfedoraprojectfedoraVulnerable target · 1 assertions
Version 39Canonical identity product-c96c7662a6606ed7594747da3d7ba9ee3a9758ab11658f6a3f42616361472e47Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b8edb836-4e6a-4b71-b9b2-aa3e03e0f646
NVD CPE · OPERATING SYSTEMlinuxlinux_kernelVulnerable target · 5 assertions
Any version (unconstrained) (>= 3.15, < 5.15.149); Any version (unconstrained) (>= 6.1, < 6.1.76); Any version (unconstrained) (>= 6.2, < 6.6.15); Any version (unconstrained) (>= 6.7, < 6.7.3); Version 6.8Canonical identity product-0eda7a801761be4590f267cf319481c8c0aaa30546d99cc064edf77989ce05c9Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 1
    Logic
    OR
    Version bounds
    from including 6.1; through excluding 6.1.76
    Match ID
    6c314dac-5c93-4d09-a1e8-b29bcfcec928
  2. cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    b9f4ea73-0894-400f-a490-3a397ab7a517
  3. cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 3
    Logic
    OR
    Version bounds
    from including 6.7; through excluding 6.7.3
    Match ID
    58fd5308-148a-40d3-b36a-0ca6b434a8bf
  4. cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 2
    Logic
    OR
    Version bounds
    from including 6.2; through excluding 6.6.15
    Match ID
    87c718cb-ae3d-4b07-b4d9-bff64183c468
  5. cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    from including 3.15; through excluding 5.15.149
    Match ID
    9e23b69a-dc79-4abd-a29d-0cfdfa41f671
NVD CPE · HARDWAREnetapp500fEnvironmental constraint · 1 assertions
Version not applicableCanonical identity product-bce9e583b1f49ea5c0bd5a00f840f38e7aa7951b6ba2e7202b8145dee6a8cdf3Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    5 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f21de67f-cdfd-4d36-9967-633cd0240c6f
NVD CPE · OPERATING SYSTEMnetapp500f_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-81bae88e6770cb8bc52ea4c51671e6fa73526f40f4d74903dba26dd506528accLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    5 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    ecf32bb1-9a58-4821-ae49-5d5c8200631f
NVD CPE · HARDWAREnetappa250Environmental constraint · 1 assertions
Version not applicableCanonical identity product-39d98651dba72dff81f6ba3200e5fadb8dd1fbb43f30e5efedad1908d0672367Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    4 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    281dfc67-46bb-4fc2-be03-3c65c9311f65
NVD CPE · OPERATING SYSTEMnetappa250_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-6e53617d28b3494048c670572dbfdec7444d9e6bfdb46b52154b1caf31aecebdLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    1236b66d-eb11-4324-929f-e2b86683c3c7
NVD CPE · HARDWAREnetappc250Environmental constraint · 1 assertions
Version not applicableCanonical identity product-81eb33109c31a4237933ba812ce110b56b71ff0f4d92452756a4ce64c4b6284dLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    58de2b52-4e49-4cd0-9310-00291b0352c7
NVD CPE · OPERATING SYSTEMnetappc250_firmwareVulnerable target · 1 assertions
Version not applicableCanonical identity product-22c964a2123b48ccc0f33f04f9ff63daf5adc2214000936708b0cc671be0d39bLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    f1ab1ec2-2560-494a-a51b-6f20ce318feb
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_desktopVulnerable target · 1 assertions
Version 7.0Canonical identity product-ebce605e64c58caa7df6a30e91702332cd8c0be8f801e44353e6350e913ec5aeLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    33c068a4-3780-4eab-a937-6082df847564
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_for_ibm_z_systemsVulnerable target · 1 assertions
Version 7.0_s390xCanonical identity product-fab9230751e41d94860bfa2eaae4ca0e74c5c60f58631aa282686d100ad4fa0bLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2148300c-ecbd-4ed5-a164-79629859dd43
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_for_power_big_endianVulnerable target · 1 assertions
Version 7.0_ppc64Canonical identity product-fd0893ef7253031c8ee72effb6fcc65181f9b3f5e01f8f48b6a6ab89a31380a9Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8bcf87fd-9358-42a5-9917-25df0180a5a6
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_for_power_little_endianVulnerable target · 1 assertions
Version 7.0_ppc64leCanonical identity product-d01c6ee0421fbc3321008543c2e5581950beffd4af6868b9a4ce0cf3d25d9429Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    7a584aaa-a14f-4c64-8fed-675dc36f69a3
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_serverVulnerable target · 1 assertions
Version 7.0Canonical identity product-8db20157ede2f731f576213a7e555a24d2424bb17aed8e43ad9b77c3587f9deaLinked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    51ef4996-72f4-4fa4-814f-f5991e7a8318
NVD CPE · OPERATING SYSTEMredhatenterprise_linux_workstationVulnerable target · 1 assertions
Version 7.0Canonical identity product-b2aa744c9fb2b4ef0e3b842acbf37879ad4ac43af291292cfb0906170b204ab9Linked exact
Scope supported
Inspect raw assertion
  1. cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    825ece2d-e232-46e0-a047-074b34db1e97

Affected-product evidence

Accepted scope and product mapping

0 canonical links · 2 source-reported links

Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
2
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
1e939b84-d89c-43eb-8dc3-1d4e1012464bb6d2d14e-8de4-45d9-9c7a-d5fb1ab969f0
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Nvd cpe vulnerable target
Assertions
22
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
01f05f8a-3eda-4f63-a4a1-1750ad14b06f093d8e9d-9041-4d73-af64-cbb4d612d3181910cb4b-62f3-4002-b4ca-3be02e9fc926236f386b-1461-4b14-baa6-d4f1e28761a6261182be-178d-4d7a-a6ad-f097999f5189299246a4-dbbe-4e12-9df6-7d439e13fb102dd925f3-3489-48f2-97a9-6aa4cf714dee476d685a-cf28-48e7-b864-948aca22f8424e8fd7b1-265c-4feb-a868-37c0d27e67c9537dde85-29a8-404b-a80e-fea610f65a8c615b25e9-dbdf-40a8-97c8-e14062c9328a6719b762-16bf-4fee-8eeb-64b23816129284605f2c-8a53-48a2-a14b-368778f11da58855064d-5289-4d9a-b48c-f195ec16d868a693d572-7136-4a03-83db-f1dcf0fbfd67a76d3ecf-a2c4-4f02-a898-357a0f41cd65d066520c-9bf8-4da9-a55e-ccc424827221d08030c6-bfe4-4df9-bc3c-1d8f9603d269dd0d8700-5a17-4ef9-ba97-d5c666b97163e66729b4-4c53-4a09-9120-bcf9f93ec249e6d33810-d986-4de2-94be-8d0eadf8337aeb92bd97-4e5e-4d6a-89a5-792f773a959f

Assessments

CVSS by origin

7.8
NVDCVSS 3.1 · role Primary · priority eligiblevalid_matchCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8
cve-coordination@google.comCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8
GoogleCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Direct CVE/CNA normalized decisions

7.8Priority eligible

Google

CVSS 3.1 · Primary · Original assertion · rank 1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Validation
Valid match
Recomputed
7.8
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.