CVE-2024-43864

What it actually does

Failure to allocate a new modify header context during CT entry update in mlx5e leaves an error pointer that panics on deallocation and leaks the prior header pointer stored in the old attr.

Why it matters to the business

Kernel panics can cause unplanned downtime and service interruption on systems using affected mlx5 networking hardware; low EPSS and absence from KEV indicate limited active exploitation risk nearly two years after disclosure.

How an attack unfolds

An attacker or legitimate workload triggers repeated CT entry updates under resource pressure that exceeds firmware modify-header limits; allocation failure converts the pointer to an error value whose later dereference crashes the kernel, while the original header is lost.

How to fix it

Upgrade to Linux kernel commit daab2cc17b6b6ab158566bba037e9551fd432b59 or later stable releases that contain the fix restoring the original attr on allocation failure.

How to confirm the fix worked

Confirm the running kernel contains commit daab2cc17b6b6ab158566bba037e9551fd432b59; attempt CT entry updates under high modify-header pressure and verify absence of panic or leaked contexts.

Typical attack path

1. Reach a system running an unpatched Linux kernel with mlx5e and CT enabled
2. Induce conditions that force repeated CT entry modify-header allocations until firmware limit is hit
3. Trigger deallocation path that dereferences the error pointer or frees the stale attr
4. Cause kernel panic and denial of service

How to detect it

Review kernel logs for oops/panic messages referencing mlx5e modify header or CT entry update paths; correlate with recent CT configuration changes.

What your security team should do

• Prioritize kernel upgrade on all mlx5e-equipped hosts within standard change windows
• Monitor EPSS and KEV updates for any future rise in exploit maturity
• Test the fixed kernel in a staging environment that exercises CT and modify-header paths