CVE-2024-35835

What it actually does

Double-free of ft->g pointer in mlx5e ARFS when kvzalloc for 'in' fails inside arfs_create_groups, followed by mlx5e_destroy_flow_table freeing the same pointer again, resulting in memory corruption.

Why it matters to the business

Systems with Mellanox mlx5e network adapters may suffer kernel panics or instability during flow table creation under allocation pressure, leading to network service disruption and unplanned downtime on servers and appliances.

How an attack unfolds

An attacker with local access or control over network configuration triggers the error path in arfs_create_groups on an mlx5e-equipped system by inducing kvzalloc failure, then invokes mlx5e_destroy_flow_table to cause the double-free and subsequent memory corruption for potential privilege escalation.

How to fix it

Upgrade the Linux kernel to the fixed commit e3d3ed8c152971dbe64c92c9ecb98fdb52abb629 or any later stable release containing the patch; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Confirm the presence of the fix commit in the kernel source tree or verify that arfs_create_groups no longer frees ft->g on kvzalloc failure before returning.

Typical attack path

1. Locate Linux system using mlx5e driver with ARFS enabled
2. Force allocation failure inside arfs_create_groups via resource exhaustion
3. Trigger mlx5e_destroy_flow_table on the partially created table
4. Exploit resulting double-free for memory corruption or code execution

How to detect it

Inspect kernel ring buffer and dmesg for slab allocator warnings or use-after-free reports referencing arfs_create_groups, mlx5e_destroy_flow_table, or flow table group pointers.

What your security team should do

• Apply the kernel update containing commit e3d3ed8c152971dbe64c92c9ecb98fdb52abb629 to all affected hosts without delay
• Prioritize patching on high-availability or externally exposed systems using mlx5e hardware
• Review kernel logs for mlx5e-related allocation failures and double-free warnings