CVE-2024-1086 Vulnerability: Critical Privilege Escalation Flaw in Linux Kernel Exploited in the Ransomware Attacks

CISA confirmed active exploitation of CVE-2024-1086, a critical use-after-free in the Linux kernel netfilter (CVSS 7.8) that allows local attackers to escalate to root and has a public PoC; threat actors are leveraging it in ransomware campaigns to disable protections, move laterally, and establish persistence. Organizations are advised to patch affected kernels, apply mitigations such as disabling unprivileged namespace creation (kernel.unprivileged_userns_clone=0), and verify deployment across Linux estates.