US government warns Linux flaw is now being exploited for ransomware attacks

• CVE-2024-1086, a Linux kernel flaw, is now exploited in active ransomware campaigns
• The bug enables local privilege escalation and affects major distros like Ubuntu and Red Hat
• CISA urges patching or mitigation, warning of significant risk to federal and enterprise systems

The US government is warning that a Linux flaw introduced more than a decade ago – and fixed more than a year ago – is being actively used in ransomware attacks.

In February 2014, a vulnerability was introduced into the Linux kernel via a commit. The bug was first disclosed in late January 2024, and described as a “use-after-free weakness in the netfilter: nf_tables kernel component”. It was fixed later that month, and was given a label CVE-2024-1086. Its severity score is 7.8/10 (high) and can be exploited to achieve local privilege escalation.