CVE-2024-57801

What it actually does

Use-after-free in mlx5e driver when accessing freed vport rep structures (rpriv->netdev or tc_ht) during netdev unregistration after vport rep unload on driver unload path.

Why it matters to the business

Kernel instability or crashes on systems using mlx5 Ethernet adapters during driver unload or reload cycles, with low but non-zero risk of local privilege escalation; affects numerous Linux distributions and downstream packages with high ecosystem prevalence.

How an attack unfolds

An attacker with local access triggers repeated driver unload/reload sequences or network interface events on mlx5 hardware, racing the unregister_netdev call against freed vport rep data structures to trigger the use-after-free for memory corruption or code execution.

How to fix it

Upgrade to fixed kernel versions containing commit 3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0 or apply the listed apr-util package updates (1.5.3-1ubuntu0.1~esm1 for 14.04, 1.5.4-1ubuntu0.1~esm1 for 16.04, 1.6.1-2 for 18.04) and reboot or reload the mlx5 driver.

How to confirm the fix worked

Confirm kernel source contains the skip-loaded-flag check in net/mlx5e/rep/tc.c, verify package versions match the fixed releases, and test driver unload/reload cycles on mlx5 hardware without crashes.

Typical attack path

1. Obtain local access on target Linux system with mlx5 NIC
2. Trigger mlx5 driver unload or netdev unregistration sequence
3. Race access to already-freed rpriv structures during TC rule restore
4. Exploit resulting use-after-free for memory corruption or privilege escalation

How to detect it

Review kernel logs for use-after-free warnings or oops during mlx5 driver unload, inspect netdev and TC hashtable access patterns around vport rep teardown, and correlate with process activity triggering interface changes.

What your security team should do

• Prioritize patching Linux kernel and apr-util packages on all systems with mlx5 adapters within standard maintenance windows
• Monitor EPSS and threat actor activity for any increase in exploitation attempts
• Test driver reload paths in staging environments before production rollout