CVE-2024-42142

What it actually does

Missing creation of ingress ACL table when esw_port_metadata is disabled via devlink, causing a kernel panic on drop rule creation for active-backup LAG mode in mlx5 E-switch.

Why it matters to the business

Unexpected system crashes on Linux hosts using Mellanox mlx5 network adapters with active-backup link aggregation and the port metadata parameter disabled, leading to network downtime and potential service disruption.

How an attack unfolds

An attacker with local or privileged access configures the system to disable esw_port_metadata and enables active-backup LAG mode, triggering the code path that attempts to use a non-existent ingress ACL and causes a kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit bc3ff8d3c05044de57865ebbb78cca8f7da3e595 or later; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit bc3ff8d3c05044de57865ebbb78cca8f7da3e595; test by setting esw_port_metadata false and creating active-backup LAG without observing a panic.

Typical attack path

1. Disable esw_port_metadata via devlink command
2. Configure active-backup LAG mode on mlx5 interface
3. Trigger creation of a drop rule that references the missing ingress ACL
4. Kernel panics due to NULL or uninitialized ACL reference

How to detect it

Review kernel logs and dmesg for mlx5 E-switch panic messages triggered during LAG or devlink operations; check system boot history for unexpected reboots after network configuration changes.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on affected mlx5 systems
• Audit devlink configurations for esw_port_metadata=false combined with active-backup LAG
• Monitor kernel logs for panic signatures related to mlx5 ingress ACL during LAG setup