VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 20, 2024· Updated May 12, 2026

CVE-2024-36007

CVE-2024-36007

Description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_acl_tcam: Fix warning during rehash

As previously explained, the rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters.

When the work runs out of credits it stores the current chunk and entry as markers in the per-work context so that it would know where to resume the migration from the next time the work is scheduled.

Upon error, the chunk marker is reset to NULL, but without resetting the entry markers despite being relative to it. This can result in migration being resumed from an entry that does not belong to the chunk being migrated. In turn, this will eventually lead to a chunk being iterated over as if it is an entry. Because of how the two structures happen to be defined, this does not lead to KASAN splats, but to warnings such as [1].

Fix by creating a helper that resets all the markers and call it from all the places the currently only reset the chunk marker. For good measures also call it when starting a completely new rehash. Add a warning to avoid future cases.

[1] WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0 Modules linked in: CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_afk_encode+0x242/0x2f0 [...] Call Trace:

mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290 mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's mlxsw Spectrum ACL TCAM driver, a rehash bug can corrupt filter migration, causing a kernel warning.

Vulnerability

In the Linux kernel's mlxsw driver, specifically in spectrum_acl_tcam, a bug occurs during the rehash process that migrates ACL filters between regions. The driver maintains markers to track progress within a chunk (filters of the same priority). When a rehash work item runs out of credits, it saves the current chunk and entry markers. However, upon error, only the chunk marker is reset to NULL, but the entry markers are not, leading to a mismatch where migration resumes from an entry that no longer belongs to the chunk being processed. This eventually causes the code to treat a chunk as an entry, triggering a warning in mlxsw_afk_encode [1].

Exploitation

This is a local vulnerability that can be triggered during normal operation of the mlxsw driver when rehashing ACL TCAM regions. No special privileges are required beyond what is needed to manage network ACLs; the bug manifests as a kernel warning (not a crash) during driver rehash operations. The attack surface is limited to systems using Mellanox Spectrum switches and the mlxsw driver.

Impact

The impact is a kernel warning, which, while not immediately compromising system integrity or confidentiality, can indicate a loss of data integrity in the ACL tables. The warning itself may lead to system instability or denial of service in scenarios where the rehash is critical for performance. The bug does not appear to allow privilege escalation or arbitrary code execution based on the available information.

Mitigation

The fix is implemented by creating a helper function that resets all markers (chunk and entry) and calling it from all relevant locations, including when starting a completely new rehash. The fix is committed in the Linux kernel stable tree [3][4]. Users should update to a patched kernel version. The CVE has a CVSS v3 score of 5.5 (Medium) and is classified under CWE-476 (NULL Pointer Dereference) in some references [1].

References
  1. SSA-613116
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

105

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.