CVE-2024-26856

What it actually does

Use-after-free in sparx5_del_mact_entry where the vid field of a mac_entry structure is read after devm_kfree has already released the memory.

Why it matters to the business

Systems using the Sparx5 Ethernet switch driver risk kernel instability or compromise, potentially requiring emergency reboots or exposing the host to further attacks until the kernel is updated.

How an attack unfolds

An attacker with the ability to add and remove MAC table entries triggers the deletion path; the driver frees the entry and then immediately dereferences the now-invalid vid pointer, allowing a crafted subsequent allocation to place attacker-controlled data at that address for memory corruption.

How to fix it

Upgrade the Linux kernel to the commit e46274df1100fb0c06704195bfff5bfbd418bf64 or any later stable release that includes the corrected sparx5_del_mact_entry logic; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Confirm the running kernel contains commit e46274df1100fb0c06704195bfff5bfbd418bf64, then exercise MAC table add/delete operations under memory-pressure conditions while monitoring for use-after-free warnings in the kernel log.

Typical attack path

1. Obtain local or network access sufficient to manipulate the MAC table via the Sparx5 driver
2. Cause repeated add/delete operations on MAC entries to race with the flawed deletion routine
3. Leverage the resulting use-after-free for memory corruption or information disclosure
4. Escalate to kernel code execution or trigger denial of service

How to detect it

Search kernel logs for sparx5-related oops or slab-use-after-free warnings immediately following MAC table modification events; correlate with process activity that interacts with the switchdev or bridge interfaces.

What your security team should do

• Prioritize kernel updates on all systems exposing the Sparx5 driver within the next maintenance window
• Add the fixed commit identifier to automated kernel-version compliance checks
• Review any custom out-of-tree Sparx5 patches for similar use-after-free patterns