Security readout for executives and security teams
Plain-English summary
This is a Linux kernel bug in the Mellanox Spectrum ACL TCAM code. In a specific error path, the kernel can dereference a NULL pointer and crash. The business risk is mainly availability loss on systems using this networking driver path, not confirmed data theft or remote compromise.
Executive priority
Treat as a targeted kernel availability risk. It is not known exploited, but affected network infrastructure could crash under the vulnerable error path. Prioritize patching where Mellanox Spectrum hardware or switch-like Linux networking roles are present.
Technical view
The flaw is in mlxsw spectrum_acl_tcam. If attaching a region to an ACL group fails, mlxsw_sp_acl_tcam_region_destroy() can access region->group->tcam when group is NULL. The recorded trace reaches this through traffic-control flower filter replacement and rtnetlink handling. The upstream fix retrieves the TCAM pointer through mlxsw_sp_acl_to_tcam().
Likely exposure
Exposure appears limited to Linux systems using the mlxsw Spectrum networking driver and ACL TCAM traffic-control offload paths. General Linux systems without this driver, hardware, or configuration path are less likely affected. The bundle lists Linux kernel version ranges but does not provide CVSS or full product packaging details.
Exploitation context
The bundle shows a kernel NULL pointer dereference and marks KEV as false. No cited source confirms active exploitation, public weaponization, or a complete attacker model. The stack trace suggests the vulnerable path is tied to traffic-control filter changes, but the source does not define required privileges.
Researcher notes
Evidence supports a NULL pointer dereference in an error path, with upstream stable commits referenced. Severity, CVSS, CWE, privilege requirements, and exploitability are not provided in the bundle. Avoid broad Linux-wide urgency unless local inventory confirms the mlxsw Spectrum ACL path is in use.
Mitigation direction
- Update affected Linux kernels using vendor or distribution guidance.
- Prioritize systems using Mellanox Spectrum mlxsw networking features.
- Review Debian LTS and other distribution kernel advisories.
- Limit unnecessary access to network traffic-control administration until patched.
- Monitor kernel logs for mlxsw_sp_acl_tcam_region_destroy crashes.
Validation and detection
- Inventory kernels and identify systems with mlxsw Spectrum hardware or modules.
- Compare installed kernel packages against vendor fixed versions or stable commits.
- Check whether traffic-control flower offload features are enabled.
- Review crash logs for NULL pointer dereferences in mlxsw_sp_acl_tcam_region_destroy.
- Track distro advisories for backported fixes and reboot requirements.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26595 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/75fa2d8b3c0175b519c99ace54ab8474cfd0077eCVE reference, Linux
- https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39CVE reference, Linux
- https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1fCVE reference, Linux
- https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.