CVE-2024-1086 Root Cause & Exploitation

Target kernels: Linux < 6.8 (netfilter nf_tables)

Novel angle: Logic confusion in nft_verdict_init causes refcount double-free, exploitable via heap spray to arbitrary memory write.

Table of Contents

1. Background — netfilter / nf_tables overview
2. Root Cause Analysis — the nft_verdict_init logic confusion
3. Vulnerable Kernel Code — annotated source excerpts
4. Proof of Concept — trigger and exploit code
5. Exploitation Strategy — heap spray to arbitrary write
6. References