CVE-2024-26595

What it actually does

NULL pointer dereference in mlxsw_sp_acl_tcam_region_destroy when invoked from the error path of mlxsw_sp_acl_tcam_vchunk_get after failing to attach a region to an ACL group, dereferencing region->group->tcam.

Why it matters to the business

May cause kernel crashes leading to denial of service and system restarts on affected Linux systems handling network ACL or traffic control rules.

How an attack unfolds

A local attacker triggers an error during ACL region attachment while adding a flower filter or TC rule, forcing the vulnerable error path that dereferences a NULL pointer and crashes the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 75fa2d8b3c0175b519c99ace54ab8474cfd0077e which retrieves the tcam pointer via mlxsw_sp_acl_to_tcam().

How to confirm the fix worked

Confirm the presence of the corrected mlxsw_sp_acl_tcam_region_destroy implementation and absence of the direct region->group->tcam access in the source tree.

Typical attack path

1. Obtain local access on a vulnerable Linux kernel
2. Invoke netfilter or traffic control operations that reach mlxsw_sp_flower_replace and mlxsw_sp_acl_rule_add
3. Force an attachment failure to mlxsw_sp_acl_tcam_region_destroy error path

How to detect it

Search kernel logs and crash dumps for NULL pointer dereference entries with call traces containing mlxsw_sp_acl_tcam_region_destroy and mlxsw_sp_acl_tcam_vchunk_get.

• mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0
• mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20
• BUG: kernel NULL pointer dereference, address: 0000000000000000

What your security team should do

• Apply the referenced kernel commit or update to a patched stable release
• Review systems using mlxsw Spectrum ACL features for exposure
• Monitor kernel logs for related oops messages