LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35960: net/mlx5: Properly link new fs rules into the tree

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, create_flow_handle tries hard to find and reference already existing identical rules instead of creating new ones. These two behaviors can result in a situation where create_flow_handle 1) creates a new rule and references it, then 2) in a subsequent step during the same handle creation references it again, resulting in a rule with a refcount of 2 that is not linked into the tree, will have a NULL parent and root and will result in a crash when the flow group is deleted because del_sw_hw_rule, invoked on rule deletion, assumes node->parent is != NULL. This happened in the wild, due to another bug related to incorrect handling of duplicate pkt_reformat ids, which lead to the code in create_flow_handle incorrectly referencing a just-added rule in the same flow handle, resulting in the problem described above. Full details are at [1]. This patch changes add_rule_fg to add new rules without parents into the tree, properly initializing them and avoiding the crash. This makes it more consistent with how rules are added to an FTE in create_flow_handle.

CriticalCVSS 9.1Not KEV-listedUpdated
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2024-35960 is a Linux kernel flaw in the mlx5 network driver path. Under specific flow-rule handling, a rule can be left outside the expected tree structure and later crash the kernel when deleted. The practical business risk is service disruption on affected Linux systems using this driver family.

Executive priority

Treat as urgent for infrastructure that depends on mlx5 networking or vendor appliances. The score is critical because a network-adjacent kernel crash can affect availability, but prioritization should be asset-based because exploitability evidence is incomplete.

Technical view

The bug is in net/mlx5 flow steering rule insertion. create_flow_handle can reference a just-created identical rule twice, leaving it with refcount 2 but no parent/root linkage. Later flow group deletion calls del_sw_hw_rule, which assumes node->parent is non-NULL, causing a NULL pointer dereference crash.

Likely exposure

Exposure is most likely on Linux systems using the mlx5 driver, commonly associated with Mellanox/NVIDIA ConnectX-class networking. The supplied data lists Linux kernel affected ranges and stable commit fixes, but does not prove every Linux deployment is reachable or affected.

Exploitation context

CISA KEV is false, and the provided sources do not confirm malicious exploitation. The kernel text says the crash happened in the wild due to another duplicate pkt_reformat ID handling bug, but that is operational occurrence evidence, not proof of active attack.

Researcher notes

Focus review on mlx5 flow steering, duplicate pkt_reformat IDs, rule refcounting, and parent/root initialization. The source indicates the fix links parentless new rules into the tree, aligning add_rule_fg behavior with create_flow_handle expectations.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fixes.
  • Use distribution advisories, including Debian LTS, for package-specific remediation.
  • Prioritize internet-facing or high-availability hosts using mlx5 networking.
  • Check Siemens advisories for affected appliances or embedded deployments.
  • If vendor guidance is absent, request confirmation from the Linux distributor or device vendor.

Validation and detection

  • Inventory kernel versions on systems with mlx5-capable network adapters.
  • Confirm whether mlx5 modules or hardware are present and active.
  • Map running kernels against vendor fixed package advisories.
  • Review crash logs for mlx5 flow steering or NULL pointer dereference indicators.
  • Verify patched kernels are booted, not only installed.
Prepared
Confidence
medium
Sources
12

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-476: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-35960 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
13Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.1CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H3.95.2CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

9.1Critical
CVSS 3.1 vector shape for CVE-2024-35960Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux74491de937125d0c98c9b9c9208b4105717a3caa, 74491de937125d0c98c9b9c9208b4105717a3caa, 74491de937125d0c98c9b9c9208b4105717a3caa, 74491de937125d0c98c9b9c9208b4105717a3caa, 74491de937125d0c98c9b9c9208b4105717a3caa, 74491de937125d0c98c9b9c9208b4105717a3caa, 74491de937125d0c98c9b9c9208b4105717a3caa, 74491de937125d0c98c9b9c9208b4105717a3caaunaffected
LinuxLinux4.10, 0, 4.19.313, 5.4.275, 5.10.216, 5.15.156, 6.1.87, 6.6.28, 6.8.7, 6.9affected
Weakness

CWE details

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-476 · source CWE mapping

NULL Pointer Dereference

NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.