Privilege Escalation Vulnerability in Linux Kernel Exploited in Ransomware Attacks
Summary
Hide ▲
Show ▼
A high-severity privilege escalation flaw in the Linux kernel (CVE-2024-1086) is being exploited in ransomware attacks. Disclosed in January 2024, the vulnerability allows attackers with local access to escalate privileges to root level. It affects multiple major Linux distributions, including Debian, Ubuntu, Fedora, and Red Hat. The flaw was introduced in February 2014 and fixed in January 2024. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed the exploitation in ransomware campaigns and added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog in May 2024. Federal agencies were ordered to secure their systems by June 20, 2024. Mitigations include blocking 'nf_tables', restricting access to user namespaces, or loading the Linux Kernel Runtime Guard (LKRG) module.
Timeline
-
31.10.2025 15:05 1 articles · 10d ago
CISA Confirms Exploitation of Linux Kernel Privilege Escalation Flaw in Ransomware Attacks
CISA confirmed on October 31, 2025, that the high-severity privilege escalation flaw in the Linux kernel (CVE-2024-1086) is being exploited in ransomware attacks. The flaw, disclosed in January 2024, allows attackers to escalate privileges to root level on compromised devices. It affects multiple major Linux distributions and was introduced in February 2014. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog in May 2024 and ordered federal agencies to secure their systems by June 20, 2024. Mitigations include blocking 'nf_tables', restricting access to user namespaces, or loading the Linux Kernel Runtime Guard (LKRG) module.
Show sources
- CISA: High-severity Linux flaw now exploited by ransomware gangs — www.bleepingcomputer.com — 31.10.2025 15:05
Information Snippets
-
The vulnerability (CVE-2024-1086) is a use-after-free weakness in the netfilter: nf_tables kernel component.
First reported: 31.10.2025 15:051 source, 1 articleShow sources
- CISA: High-severity Linux flaw now exploited by ransomware gangs — www.bleepingcomputer.com — 31.10.2025 15:05
-
The flaw was introduced in February 2014 and fixed in January 2024.
First reported: 31.10.2025 15:051 source, 1 articleShow sources
- CISA: High-severity Linux flaw now exploited by ransomware gangs — www.bleepingcomputer.com — 31.10.2025 15:05
-
Successful exploitation allows attackers to escalate privileges to root level on compromised devices.
First reported: 31.10.2025 15:051 source, 1 articleShow sources
- CISA: High-severity Linux flaw now exploited by ransomware gangs — www.bleepingcomputer.com — 31.10.2025 15:05
-
The vulnerability affects Linux kernel versions 3.15 to 6.8-rc1.
First reported: 31.10.2025 15:051 source, 1 articleShow sources
- CISA: High-severity Linux flaw now exploited by ransomware gangs — www.bleepingcomputer.com — 31.10.2025 15:05
-
Major Linux distributions impacted include Debian, Ubuntu, Fedora, and Red Hat.
First reported: 31.10.2025 15:051 source, 1 articleShow sources
- CISA: High-severity Linux flaw now exploited by ransomware gangs — www.bleepingcomputer.com — 31.10.2025 15:05
-
CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog in May 2024.
First reported: 31.10.2025 15:051 source, 1 articleShow sources
- CISA: High-severity Linux flaw now exploited by ransomware gangs — www.bleepingcomputer.com — 31.10.2025 15:05
-
Federal agencies were ordered to secure their systems by June 20, 2024.
First reported: 31.10.2025 15:051 source, 1 articleShow sources
- CISA: High-severity Linux flaw now exploited by ransomware gangs — www.bleepingcomputer.com — 31.10.2025 15:05
-
Mitigations include blocking 'nf_tables', restricting access to user namespaces, or loading the Linux Kernel Runtime Guard (LKRG) module.
First reported: 31.10.2025 15:051 source, 1 articleShow sources
- CISA: High-severity Linux flaw now exploited by ransomware gangs — www.bleepingcomputer.com — 31.10.2025 15:05