VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 20, 2024· Updated May 12, 2026

CVE-2024-36006

CVE-2024-36006

Description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_acl_tcam: Fix incorrect list API usage

Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_first_entry() on the respective lists without checking that the lists are not empty. This is incorrect usage of the API, which leads to the following warning [1].

Fix by returning if the lists are empty as there is nothing to migrate in this case.

[1] WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> Modules linked in: CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 [...] Call Trace:

mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's mlxsw driver, incorrect list API usage can lead to a warning when migrating ACL chunks or entries on an empty list, resulting in a denial of service.

Vulnerability

Overview

CVE-2024-36006 is a denial-of-service vulnerability in the Linux kernel's Mellanox Spectrum switch driver (mlxsw), specifically in spectrum_acl_tcam.c. The functions mlxsw_sp_acl_tcam_vchunk_migrate_all and the entry migration counterpart call list_first_entry() without first checking if the list is empty. This incorrect usage of the kernel list API triggers a kernel warning (WARN_ON) when a rehash workqueue operation attempts to migrate chunks or entries on an empty list, as shown by the call trace in the description [1].

Attack

Vector and Prerequisites

The vulnerability is exploitable locally by an attacker with the ability to trigger a rehash operation on the ACL TCAM region. This occurs when the system processes a workqueue (mlxsw_sp_acl_tcam_vregion_rehash_work) that attempts to migrate all chunks or entries in a region, but the lists are unexpectedly empty. The issue requires local access to the system and the ability to manipulate the network driver's ACL configuration, typically through privileged operations such as adding or deleting TCAM filters.

Impact

An attacker exploiting this vulnerability can cause a kernel warning, which may lead to system instability or a denial of service if the warning is escalated to a panic or if the system becomes unresponsive. The CVSS v3 base score of 5.5 (Medium) reflects the local attack vector, low complexity, and potential for high availability impact [2]. No confidentiality or integrity impact is expected, as the bug only causes a warning without data corruption.

Mitigation

Status

The fix, introduced in the Linux kernel, adds a check for empty lists before calling list_first_entry(), returning early if there is nothing to migrate [3][4]. The patch has been applied to the kernel source tree. Users should update to a kernel version containing the commit referenced in the stable tree (e.g., commit 09846c2309b1 or 64435b64e43d). The Siemens advisory (SSA-265688) confirms the vulnerability affects SIMATIC S7-1500 TM MFP devices with the GNU/Linux subsystem, and users of those products should apply the recommended remediation.

References
  1. SSA-265688
  2. SSA-613116
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

105

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.