CVE-2024-26586

What it actually does

Stack corruption in mlxsw_sp_acl_tcam_group_update when more than 16 ACLs are placed in a single group on Spectrum-2 and newer ASICs because the PAGT register layout was not updated to match the larger firmware-reported maximum.

Why it matters to the business

Kernel panic and immediate system crash on affected Linux hosts when tc filters are added in certain priority patterns, leading to denial of service and potential loss of network connectivity or workloads.

How an attack unfolds

An attacker with local root privileges adds tc flower filters to a net device using decreasing priorities in an alternating order that forces more than 16 ACLs into one group; the driver writes beyond the PAGT register boundary, triggering stack-protector failure and kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 56750ea5d15426b5f307554e7699e8b5f76c3182 or later; the fix caps the ACL group size at the minimum of the firmware-reported value and the PAGT register capacity.

How to confirm the fix worked

Confirm the running kernel contains commit 56750ea5d15426b5f307554e7699e8b5f76c3182; reproduce the original crash scenario with a test that attempts to attach more than 16 ACL regions and verify the system no longer panics.

Typical attack path

1. Obtain local root or CAP_NET_ADMIN on the target host
2. Create or identify a net device bound to an mlxsw Spectrum-2+ ASIC
3. Issue a series of tc filter add commands with carefully chosen decreasing priorities
4. Trigger the ACL group update path that exceeds the 16-entry limit
5. Cause stack corruption and kernel panic

How to detect it

Search kernel logs and dmesg for stack-protector panics containing mlxsw_sp_acl_tcam_group_update, mlxsw_sp_acl_tcam_group_region_attach, or __stack_chk_fail; correlate with recent tc filter additions on mlxsw devices.

• mlxsw_sp_acl_tcam_group_update+0x116/0x120
• Kernel panic - not syncing: stack-protector: Kernel stack is corrupted
• __stack_chk_fail
• mlxsw_sp_acl_tcam_vchunk_get
• mlxsw_sp_flower_replace

What your security team should do

• Prioritize kernel upgrades on all systems exposing mlxsw Spectrum-2+ hardware
• Restrict unprivileged use of tc filter commands via SELinux or AppArmor policies until patched
• Monitor kernel logs for stack-protector panics referencing mlxsw_sp_acl_tcam_group_update
• Test the supplied regression test case in staging environments before broad rollout