CVE-2024-46857

What it actually does

NULL pointer dereference in mlx5_add_flow_rules triggered when bridge link set operations attempt to configure VEPA mode on an mlx5 PF with numvfs=0, because esw->fdb_table.legacy.vepa_fdb is never initialized.

Why it matters to the business

Local privileged users can crash the system with a single bridge command, causing unplanned downtime on servers using mlx5 NICs in SR-IOV configurations; low urgency given stable low EPSS and absence from KEV.

How an attack unfolds

An attacker with CAP_NET_ADMIN executes 'bridge link set dev <pf> hwmode vepa' on an mlx5 PF that has no VFs enabled; the call reaches _mlx5_eswitch_set_vepa_locked which passes a null vepa_fdb pointer to mlx5_add_flow_rules, resulting in an immediate kernel oops and denial of service.

How to fix it

Update the Linux kernel to a version containing commit 52c4beb79e095e0631b5cac46ed48a2aefe51985 or later; after the update, bridge link operations on the PF are silently ignored when no VFs exist.

How to confirm the fix worked

Confirm the running kernel contains the fix commit, then verify that 'bridge link set ... hwmode vepa' on a zero-VF mlx5 PF no longer produces a NULL pointer dereference and that the interface is absent from 'bridge link' output.

Typical attack path

1. Obtain local shell with network configuration privileges
2. Identify mlx5 PF interface with numvfs=0
3. Run bridge link set ... hwmode vepa command
4. Trigger NULL dereference and kernel panic

How to detect it

Search kernel logs and dmesg for the exact BUG line 'kernel NULL pointer dereference' followed by the RIP mlx5_add_flow_rules and the call trace containing _mlx5_eswitch_set_vepa_locked and rtnl_bridge_setlink.

• mlx5_add_flow_rules+0x1f/0x300 [mlx5_core]
• _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core]
• esw->fdb_table.legacy.vepa_fdb is null
• bridge link set dev .* hwmode vepa

What your security team should do

• Patch mlx5-based systems to the fixed kernel commit within normal maintenance windows
• Restrict bridge and ip link commands to trusted administrators via sudoers or SELinux policies
• Monitor kernel logs for mlx5 NULL dereference signatures until patches are deployed