CVE-2024-1086

CVE-2024-1086 is a use-after-free in the Linux kernel's netfilter subsystem, specifically in the nft_verdict_init() function. The vulnerability stems from a semantic contract violation: nft_verdict_init() accepts positive values as drop error codes, directly contradicting netfilter's implicit convention that reserves negative values for error codes and positive values (like NF_ACCEPT = 1) for non-error verdicts. When a positive drop error value that numerically resembles NF_ACCEPT reaches nf_hook_slow(), the verdict state machine branches incorrectly and triggers a double-free. If you are running a kernel between approximately 5.1 and the patch date (early 2024), check whether nftables (nft) rules are in use. The attack surface requires an attacker able to interact with nftables rules — this typically means container escape or privilege escalation from a network namespace context. The vulnerability is not reachable via standard iptables; only nftables expressions can trigger the vulnerable code path. The fix (commit f342de4e2f33e0e39165d8639387aa6c19dff660) adds validation to reject positive values in drop error contexts — essentially codifying what should have been an API invariant. Verify your kernel version against distribution security advisories; this fix was merged upstream before the CVE was assigned, so patched versions may not list CVE-2024-1086 explicitly. Beyond patching, audit other netfilter and XDP code paths for similar unvalidated sign-space assumptions. The broader pattern — where sign indicates category (error vs. success vs. special) across integer return values — appears throughout the kernel. This is not an isolated bug; it's a recurring class of failure where implicit conventions lack type-level enforcement. Consider whether static analysis tooling in your development pipeline could model cross-function data flow for verdict-like values.

Reviewed through automated stages and approved by a human before publication.