# Notselwyn/CVE-2024-1086

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 99.4% in KernelCTF images.

Repository: https://github.com/Notselwyn/CVE-2024-1086
Canonical: https://ross.abutalabs.com/products/cve-2024-1086
Homepage: https://pwning.tech/nftables
Language: C
License: MIT
License Family: permissive
Topics: cve, exploit, lpe, poc, cve-2024-1086
Last push: 2024-04-17T16:09:54+00:00

## Health v2 (maintenance only)
Score: 16/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 64
- inputs: {"age_days": 896, "days_push": 868, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2457, forks 330 (observed 2026-08-28T04:06:53.300674+00:00)

## What it is
A proof-of-concept local privilege escalation exploit for CVE-2024-1086, a double-free vulnerability in the Linux kernel's nf_tables subsystem. It drops a root shell on most Linux kernels between v5.14 and v6.6 (Debian, Ubuntu, KernelCTF) with a 99.4% success rate in KernelCTF images.

## Use cases
- demonstrate CVE-2024-1086 privilege escalation on a vulnerable Linux kernel
- test whether a Linux kernel between 5.14 and 6.6 is patched against the nf_tables double-free
- study kernel exploitation techniques like Dirty Pagedirectory in a lab environment
- validate kernel hardening configurations such as KernelCTF mitigation instances
- learn Linux kernel vulnerability research from a documented exploit write-up

## When to choose
- you need a working PoC for CVE-2024-1086 on Debian, Ubuntu, or KernelCTF kernels
- you are doing security research or kernel exploitation education in an isolated lab
- you want a universal exploit that works across many kernel versions without recompiling

## When to avoid
- you need a stealthy or persistent exploit - it deliberately causes a kernel panic after gaining root
- your target kernel is patched (v5.15.149+, v6.1.76+, v6.6.15+)
- the system disables unprivileged user namespaces or nf_tables, or runs a non-x64 architecture
- you need stability on systems with heavy network activity or WiFi

## Facets
- artifact type: application
- maturity: stable
- function: security, penetration-testing, cli
- domain: security, operating-systems, penetration-testing, developer-tools
- platform: cli, cpp
- tags: cve-2024-1086, local-privilege-escalation, kernel-exploit, nftables, proof-of-concept, lpe, exploit-development, use-after-free, linux

## Member repositories
- Notselwyn/CVE-2024-1086 (main) score 16

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:53.300674+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:30:01.355045+00:00, confidence not recorded.
  - readme: https://github.com/Notselwyn/CVE-2024-1086 (fetched 2026-08-28T04:06:53.300674+00:00, sha fa609f220b0e)
  - homepage: https://pwning.tech/nftables (fetched 2026-08-29T10:11:10.549293+00:00, sha 47cacd578909)
  - site_page: https://pwning.tech/about (fetched 2026-08-29T10:11:10.555435+00:00, sha 5e9ec87e9de7)
- Data as of 2026-08-30T08:39:29.467469+00:00.