CVE-2024-1085 is a High severity use after free, scored 7.8, in the Linux kernel netfilter nf_tables component. It can be exploited for local privilege escalation. The record recommends upgrading past upstream commit b1db244ffd04. Check your distribution's kernel advisory for the exact package version that carries the fix.
What's affected
The record lists the Linux kernel but gives no usable version range, only generic kernel entries. It identifies the fix by upstream commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 and recommends upgrading past it.
The flaw is in nft_setelem_catchall_deactivate(). The function checks whether a catch all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation. That makes it possible to free the element more than once, a double free. I could not read the kernel.dance page (HTTP 404) to list stable releases, so use your distribution's advisory for versions.
How to check if you're exposed
Read the running kernel and compare it with your distribution's advisory for CVE-2024-1085.
uname -r
On Debian and Ubuntu, apt changelog linux-image-$(uname -r) can show whether a changelog entry names the CVE. On Red Hat family systems, rpm -q --changelog kernel | grep CVE-2024-1085 does the same. Distributions backport fixes, so the version number alone can mislead.
If your build is custom, check whether your tree contains upstream commit b1db244ffd04.
What to do now
- Run
uname -racross your fleet and group hosts by kernel build. - Find the fixed package for each distribution in its advisory for CVE-2024-1085.
- Install the kernel update and reboot, since a new kernel only takes effect after a restart. Live patching services may cover it if you use one.
- Prioritise multi user hosts, container hosts and CI runners, where untrusted local code is most likely.
- Restrict who can run code locally on sensitive hosts until patched.
- Confirm the running kernel after the reboot.
Why it matters
The class is use after free, CWE-416, here arising from a double free in nf_tables, the kernel's packet filtering framework. A bug in the kernel hands an attacker the highest privileges on the machine, which is why local privilege escalation bugs matter on shared systems.
The score is 7.8 because the attacker needs local access first. On a single user laptop, that is a high bar. On a Kubernetes node where many workloads share a kernel, a compromised container is local access. The record's KEV flag is false, and I found no statement of exploitation in the pages I could read.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does it need local access?
Yes. The record describes it as a local privilege escalation, so an attacker must already be able to run code on the host.
Is the kernel version number enough to tell if I am patched?
Not always. Distributions backport fixes into older version numbers, so check the distribution advisory.
Sources
Last reviewed: 19 October 2026.
