CVE-2024-36006

What it actually does

Calling list_first_entry() on potentially empty lists in mlxsw_sp_acl_tcam_vchunk_migrate_all and mlxsw_sp_acl_tcam_ventry_migrate_all without prior emptiness checks triggers kernel warnings during ACL TCAM chunk and entry migration in the rehash workqueue.

Why it matters to the business

Systems using Mellanox Spectrum switches may experience kernel warnings or instability during routine ACL management, increasing operational overhead and risk of unexpected reboots on affected Linux kernels.

How an attack unfolds

An attacker with local privileges configures network ACLs to force repeated TCAM region rehashing, causing the mlxsw driver to invoke migration functions on empty lists and trigger the warning path.

How to fix it

Upgrade the Linux kernel to a version containing commit 0b2c13b670b168e324e1cf109e67056a20fd610a which adds emptiness checks before list_first_entry calls.

How to confirm the fix worked

Inspect drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c for the added early return when lists are empty; confirm absence of the WARNING stack trace after applying the fix and exercising rehash paths.

Typical attack path

1. Obtain local access on a system running the mlxsw driver
2. Trigger ACL TCAM vregion rehash via configuration changes
3. Invoke vchunk or ventry migration on empty lists
4. Observe resulting kernel WARNING in spectrum_acl_tcam.c

How to detect it

Search kernel logs and dmesg for WARNING entries containing mlxsw_sp_acl_tcam_vchunk_migrate_all or mlxsw_sp_acl_tcam_vregion_rehash_work; correlate with workqueue activity on Mellanox hardware.

• mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1
• mlxsw_sp_acl_tcam_vregion_rehash_work
• WARNING: CPU:.*PID:.*mlxsw

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all affected hosts
• Monitor kernel logs for mlxsw rehash warnings
• Test ACL reconfiguration workloads in staging before production rollout