LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35853: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash The rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters. If the migration fails, the code tries to migrate the filters back to the old region. However, the rollback itself can also fail in which case another migration will be erroneously performed. Besides the fact that this ping pong is not a very good idea, it also creates a problem. Each virtual chunk references two chunks: The currently used one ('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the first holds the chunk we want to migrate filters to and the second holds the chunk we are migrating filters from. The code currently assumes - but does not verify - that the backup chunk does not exist (NULL) if the currently used chunk does not reference the target region. This assumption breaks when we are trying to rollback a rollback, resulting in the backup chunk being overwritten and leaked [1]. Fix by not rolling back a failed rollback and add a warning to avoid future cases. [1] WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20 Modules linked in: CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:parman_destroy+0x17/0x20 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_region_fini+0x19/0x60 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>

MediumCVSS 6.4Not KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-35853 is a Linux kernel bug in the mlxsw Spectrum ACL TCAM code. A failed migration rollback can leak memory and destabilize systems using this switch driver. Business risk is mainly service availability on affected Linux-based networking platforms, not broad compromise of typical servers.

Executive priority

Treat as a targeted networking-platform maintenance item. It is not marked as actively exploited, but availability impact can matter for switch infrastructure. Patch during the next controlled kernel or appliance update cycle, sooner for exposed production switching platforms.

Technical view

During mlxsw ACL TCAM virtual-region rehash, failed migration rollback can trigger another erroneous migration. The backup chunk pointer can be overwritten and leaked when rollback of rollback occurs. The Linux fix prevents rolling back a failed rollback and adds a warning. CVSS 3.1 is 6.4 with high availability impact.

Likely exposure

Most exposed assets are Linux systems or appliances using the mlxsw Spectrum driver, commonly Mellanox/NVIDIA Spectrum switch ASIC platforms. Generic Linux workloads without this driver or hardware are less likely exposed. Exact exposure depends on the running kernel and downstream vendor backports.

Exploitation context

The bundle does not show KEV listing or active exploitation. CVSS indicates network attack vector, high complexity, low privileges, and no user interaction. Public evidence here describes a kernel memory leak triggered by failure handling during ACL TCAM rehash, not a weaponized exploit.

Researcher notes

The key condition is failed rehash migration followed by failed rollback in mlxsw_sp_acl_tcam_vregion_rehash_work. The source evidence supports memory leak and availability concern. Affected-version data is upstream-kernel oriented; downstream kernels may be patched without matching upstream version numbers.

Mitigation direction

  • Update to a vendor or distribution kernel containing the referenced stable fixes.
  • Prioritize affected Linux-based network switches and appliances using mlxsw Spectrum hardware.
  • Review Debian or distribution advisories for patched package versions before rollout.
  • If immediate patching is delayed, monitor vendor guidance for supported mitigations.
  • Schedule maintenance because kernel updates usually require reboot or image replacement.

Validation and detection

  • Inventory kernels and map them against vendor-patched versions for CVE-2024-35853.
  • Confirm whether assets use mlxsw Spectrum hardware or load the mlxsw driver stack.
  • Check distribution security advisories for backport status rather than relying only on upstream version numbers.
  • Review kernel logs for related mlxsw ACL TCAM rehash or parman warnings.
  • Verify patched kernels remain stable after ACL policy or switch configuration changes.
Prepared
Confidence
high
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-35853 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
9Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.4CVSS 3.1MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H1.64.7CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

6.4Medium
CVSS 3.1 vector shape for CVE-2024-35853Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux843500518509128a935edab96bd8efef7c54669e, 843500518509128a935edab96bd8efef7c54669e, 843500518509128a935edab96bd8efef7c54669e, 843500518509128a935edab96bd8efef7c54669e, 843500518509128a935edab96bd8efef7c54669e, 843500518509128a935edab96bd8efef7c54669e, 843500518509128a935edab96bd8efef7c54669eunaffected
LinuxLinux5.1, 0, 5.4.275, 5.10.216, 5.15.158, 6.1.90, 6.6.30, 6.8.9, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.