Skip to content
CISA Warns of Ransomware Exploiting CVE-2024-1086 in Linux Kernel

CISA Warns of Ransomware Exploiting CVE-2024-1086 in Linux Kernel

First seen 4 Nov 2025, 11:09 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 12, 2026 at 13:27 UTC

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding the exploitation of a critical vulnerability in the Linux kernel, tracked as CVE-2024-1086, by ransomware groups. This use-after-free flaw, located in the netfilter: nf_tables component, allows attackers with local access to escalate their privileges on affected systems. The vulnerability, first disclosed in January 2024, has been actively exploited despite being included in CISA's Known Exploited Vulnerabilities catalog over a year ago.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 227d ago How this analysis works

More articles in this cluster (4)

Following this threat?

Track Debian and CVE-2024-1086 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed