Detecting CVE-2024-1086: The decade-old Linux kernel vulnerability that’s being actively exploited in ransomware campaigns

This Sysdig Threat Research Team blog analyzes CVE-2024-1086, a decade-old double-free vulnerability in the Linux kernel netfilter (nftables) that can be exploited to gain root privileges. The report describes exploit mechanics (abusing unprivileged user namespaces, malformed SKBs, overwriting modprobe_path), lists affected kernel versions and patches, notes public PoC code and CISA confirmation of use in ransomware campaigns, and recommends urgent patching and runtime detection (Sysdig rules) to mitigate active exploitation.