CVE-2024-36030

What it actually does

Double free of the mcam->counters.bmap pointer in rvu_npc_freemem() after npc_mcam_rsrcs_deinit() has already released it, resulting in kernel memory corruption.

Why it matters to the business

Kernel instability, crashes, or potential privilege escalation on systems using affected Marvell OcteonTX2 network hardware; low urgency due to absence from exploitation lists and minimal EPSS score.

How an attack unfolds

An attacker with local access triggers the NPC MCAM resource initialization and deinitialization sequence in the octeontx2-af driver to hit the redundant kfree path; no named threat actors have been observed exploiting this flaw.

How to fix it

Upgrade to Linux kernel 6.8.9 or later, or apply commit f5aa87a2c0a72132ffc793fb0a5375b2a65d520a which removes the redundant kfree in rvu_npc.c.

How to confirm the fix worked

Verify the running kernel version is at or above the fixed release; inspect drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c around line 2184 to confirm absence of the duplicate kfree after npc_mcam_rsrcs_deinit.

Typical attack path

1. Obtain local code execution on a vulnerable Linux system with OcteonTX2 hardware
2. Configure or exercise the rvu_npc driver paths that allocate and free MCAM counters
3. Force repeated init/deinit cycles to trigger the double-free condition
4. Leverage resulting memory corruption for denial of service or further exploitation

How to detect it

Search kernel logs for oops or warnings referencing rvu_npc_freemem, npc_mcam_rsrcs_deinit, or double-free patterns in the octeontx2-af driver; no public exploitation artifacts are known.

What your security team should do

• Apply the kernel update to all systems exposing the octeontx2-af driver
• Prioritize systems with Marvell OcteonTX2 network adapters
• Monitor for kernel oops/panic reports mentioning rvu_npc or mcam counters
• Reassess after 30 days if EPSS remains flat