CVE-2024-35960: net/mlx5: Properly link new fs rules into the tree
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Properly link new fs rules into the tree
Previously, add_rule_fg would only add newly created rules from the
handle into the tree when they had a refcount of 1. On the other hand,
create_flow_handle tries hard to find and reference already existing
identical rules instead of creating new ones.
These two behaviors can result in a situation where create_flow_handle
1) creates a new rule and references it, then
2) in a subsequent step during the same handle creation references it
again,
resulting in a rule with a refcount of 2 that is not linked into the
tree, will have a NULL parent and root and will result in a crash when
the flow group is deleted because del_sw_hw_rule, invoked on rule
deletion, assumes node->parent is != NULL.
This happened in the wild, due to another bug related to incorrect
handling of duplicate pkt_reformat ids, which lead to the code in
create_flow_handle incorrectly referencing a just-added rule in the same
flow handle, resulting in the problem described above. Full details are
at [1].
This patch changes add_rule_fg to add new rules without parents into
the tree, properly initializing them and avoiding the crash. This makes
it more consistent with how rules are added to an FTE in
create_flow_handle.
Security readout for executives and security teams
Plain-English summary
CVE-2024-35960 is a Linux kernel flaw in the mlx5 network driver path. Under specific flow-rule handling, a rule can be left outside the expected tree structure and later crash the kernel when deleted. The practical business risk is service disruption on affected Linux systems using this driver family.
Executive priority
Treat as urgent for infrastructure that depends on mlx5 networking or vendor appliances. The score is critical because a network-adjacent kernel crash can affect availability, but prioritization should be asset-based because exploitability evidence is incomplete.
Technical view
The bug is in net/mlx5 flow steering rule insertion. create_flow_handle can reference a just-created identical rule twice, leaving it with refcount 2 but no parent/root linkage. Later flow group deletion calls del_sw_hw_rule, which assumes node->parent is non-NULL, causing a NULL pointer dereference crash.
Likely exposure
Exposure is most likely on Linux systems using the mlx5 driver, commonly associated with Mellanox/NVIDIA ConnectX-class networking. The supplied data lists Linux kernel affected ranges and stable commit fixes, but does not prove every Linux deployment is reachable or affected.
Exploitation context
CISA KEV is false, and the provided sources do not confirm malicious exploitation. The kernel text says the crash happened in the wild due to another duplicate pkt_reformat ID handling bug, but that is operational occurrence evidence, not proof of active attack.
Researcher notes
Focus review on mlx5 flow steering, duplicate pkt_reformat IDs, rule refcounting, and parent/root initialization. The source indicates the fix links parentless new rules into the tree, aligning add_rule_fg behavior with create_flow_handle expectations.
Mitigation direction
Apply Linux kernel updates containing the referenced stable fixes.
Use distribution advisories, including Debian LTS, for package-specific remediation.
Prioritize internet-facing or high-availability hosts using mlx5 networking.
Check Siemens advisories for affected appliances or embedded deployments.
If vendor guidance is absent, request confirmation from the Linux distributor or device vendor.
Validation and detection
Inventory kernel versions on systems with mlx5-capable network adapters.
Confirm whether mlx5 modules or hardware are present and active.
Map running kernels against vendor fixed package advisories.
Review crash logs for mlx5 flow steering or NULL pointer dereference indicators.
Verify patched kernels are booted, not only installed.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE-476 · source CWE mapping
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.