CVE-2024-35853: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
The rehash delayed work migrates filters from one region to another.
This is done by iterating over all chunks (all the filters with the same
priority) in the region and in each chunk iterating over all the
filters.
If the migration fails, the code tries to migrate the filters back to
the old region. However, the rollback itself can also fail in which case
another migration will be erroneously performed. Besides the fact that
this ping pong is not a very good idea, it also creates a problem.
Each virtual chunk references two chunks: The currently used one
('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the
first holds the chunk we want to migrate filters to and the second holds
the chunk we are migrating filters from.
The code currently assumes - but does not verify - that the backup chunk
does not exist (NULL) if the currently used chunk does not reference the
target region. This assumption breaks when we are trying to rollback a
rollback, resulting in the backup chunk being overwritten and leaked
[1].
Fix by not rolling back a failed rollback and add a warning to avoid
future cases.
[1]
WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20
Modules linked in:
CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14
Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019
Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work
RIP: 0010:parman_destroy+0x17/0x20
[...]
Call Trace:
<TASK>
mlxsw_sp_acl_atcam_region_fini+0x19/0x60
mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0
mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470
process_one_work+0x151/0x370
worker_thread+0x2cb/0x3e0
kthread+0xd0/0x100
ret_from_fork+0x34/0x50
ret_from_fork_asm+0x1a/0x30
</TASK>
Security readout for executives and security teams
Plain-English summary
CVE-2024-35853 is a Linux kernel bug in the mlxsw Spectrum ACL TCAM code. A failed migration rollback can leak memory and destabilize systems using this switch driver. Business risk is mainly service availability on affected Linux-based networking platforms, not broad compromise of typical servers.
Executive priority
Treat as a targeted networking-platform maintenance item. It is not marked as actively exploited, but availability impact can matter for switch infrastructure. Patch during the next controlled kernel or appliance update cycle, sooner for exposed production switching platforms.
Technical view
During mlxsw ACL TCAM virtual-region rehash, failed migration rollback can trigger another erroneous migration. The backup chunk pointer can be overwritten and leaked when rollback of rollback occurs. The Linux fix prevents rolling back a failed rollback and adds a warning. CVSS 3.1 is 6.4 with high availability impact.
Likely exposure
Most exposed assets are Linux systems or appliances using the mlxsw Spectrum driver, commonly Mellanox/NVIDIA Spectrum switch ASIC platforms. Generic Linux workloads without this driver or hardware are less likely exposed. Exact exposure depends on the running kernel and downstream vendor backports.
Exploitation context
The bundle does not show KEV listing or active exploitation. CVSS indicates network attack vector, high complexity, low privileges, and no user interaction. Public evidence here describes a kernel memory leak triggered by failure handling during ACL TCAM rehash, not a weaponized exploit.
Researcher notes
The key condition is failed rehash migration followed by failed rollback in mlxsw_sp_acl_tcam_vregion_rehash_work. The source evidence supports memory leak and availability concern. Affected-version data is upstream-kernel oriented; downstream kernels may be patched without matching upstream version numbers.
Mitigation direction
Update to a vendor or distribution kernel containing the referenced stable fixes.
Prioritize affected Linux-based network switches and appliances using mlxsw Spectrum hardware.
Review Debian or distribution advisories for patched package versions before rollout.
If immediate patching is delayed, monitor vendor guidance for supported mitigations.
Schedule maintenance because kernel updates usually require reboot or image replacement.
Validation and detection
Inventory kernels and map them against vendor-patched versions for CVE-2024-35853.
Confirm whether assets use mlxsw Spectrum hardware or load the mlxsw driver stack.
Check distribution security advisories for backport status rather than relying only on upstream version numbers.
Review kernel logs for related mlxsw ACL TCAM rehash or parman warnings.
Verify patched kernels remain stable after ACL policy or switch configuration changes.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-35853 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.