Security readout for executives and security teams
Plain-English summary
This is a Linux kernel driver bug in the mlxbf_gige network driver used on BlueField SmartNIC systems. During kdump recovery, the driver can handle a receive interrupt before NAPI is ready, causing a NULL pointer crash and kernel panic. The main business risk is failed crash-dump recovery or management-network disruption on affected systems.
Executive priority
Treat this as a targeted reliability and recovery risk rather than a broad internet-facing emergency. Patch affected BlueField/Linux platforms in normal kernel maintenance cycles, faster where kdump evidence collection or out-of-band management is operationally critical.
Technical view
The fix reorders mlxbf_gige open logic so request_irq() occurs after NAPI initialization. The CVE describes a pending RX interrupt firing immediately after request_irq(), before the RX NAPI poll handler is initialized, causing execution through a NULL pointer in the interrupt/NAPI path. CVSS, CWE, and complete severity metadata are not provided in the source bundle.
Likely exposure
Exposure appears limited to Linux systems using the mlxbf_gige driver, notably BlueField SmartNIC environments where kdump loads the module and brings up oob_net0. General Linux systems without this driver or hardware are unlikely to be exposed based on the provided sources.
Exploitation context
No active exploitation is cited, and the CVE is not marked KEV. The provided reproduction context is operational: kdump is enabled, a crash dump kernel boots, mlxbf_gige loads, and the interface opens. The source does not show remote exploitability.
Researcher notes
The source identifies a race/order-of-initialization bug around RX IRQ registration and NAPI setup. Evidence supports kernel panic during kdump recovery, but does not provide CVSS, CWE, remote attack preconditions, or public exploit status. Avoid broad claims beyond mlxbf_gige and the documented BlueField context.
Mitigation direction
- Update to a kernel containing the referenced stable mlxbf_gige fix.
- Check Linux distribution advisories for fixed kernel package versions.
- Prioritize BlueField SmartNIC hosts that rely on kdump or out-of-band networking.
- If patching is delayed, review vendor guidance for driver-specific workarounds.
- Test crash-dump recovery after applying the kernel update.
Validation and detection
- Inventory hosts using BlueField SmartNIC hardware and the mlxbf_gige driver.
- Confirm whether affected kernels match the CVE source version ranges.
- Review crash logs for mlxbf_gige_open, __napi_poll, or NULL pointer panic traces.
- Verify installed kernel changelogs include the referenced stable fix.
- Run controlled kdump validation only in an approved maintenance environment.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit a583117668ddb86e98f2e11c7caa3db0e6df52a3
- Linux stable commit 24444af5ddf729376b90db0f135fa19973cb5dab
- Linux stable commit 867a2f598af6a645c865d1101b58c5e070c6dd9e
- Linux stable commit 8feb1652afe9c5d019059a55c90f70690dce0f52
- Linux stable commit f7442a634ac06b953fc1f7418f307b25acd4cfbc
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-35907 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a583117668ddb86e98f2e11c7caa3db0e6df52a3CVE reference, Linux
- https://git.kernel.org/stable/c/24444af5ddf729376b90db0f135fa19973cb5dabCVE reference, Linux
- https://git.kernel.org/stable/c/867a2f598af6a645c865d1101b58c5e070c6dd9eCVE reference, Linux
- https://git.kernel.org/stable/c/8feb1652afe9c5d019059a55c90f70690dce0f52CVE reference, Linux
- https://git.kernel.org/stable/c/f7442a634ac06b953fc1f7418f307b25acd4cfbcCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.