CVE-2024-35835: Linux Kernel Use-After-Free Vulnerability

CVE-2024-35835 Overview

CVE-2024-35835 is a double-free vulnerability [CWE-415] in the Linux kernel's Mellanox 5 Ethernet driver (net/mlx5e). The flaw exists in the arfs_create_groups function used by Accelerated Receive Flow Steering (aRFS). When kvzalloc fails to allocate the in buffer, arfs_create_groups frees ft->g and returns an error. The sole caller, arfs_create_table, then invokes mlx5e_destroy_flow_table, which frees ft->g a second time. A local attacker with low privileges can trigger the condition to corrupt kernel memory, potentially leading to privilege escalation or denial of service.

Critical Impact
Local low-privileged users can trigger kernel memory corruption on systems using the mlx5 Ethernet driver, risking privilege escalation, denial of service, and compromise of confidentiality and integrity.

Affected Products

Linux kernel versions prior to the fixes referenced in the stable tree, including 6.8-rc1
Debian GNU/Linux 10
Distributions shipping the vulnerable net/mlx5e aRFS code path

Discovery Timeline

2024-05-17 - CVE-2024-35835 published to the National Vulnerability Database (NVD)
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2024-35835

Vulnerability Analysis

The vulnerability resides in the mlx5 Ethernet driver's Accelerated Receive Flow Steering initialization path. The arfs_create_groups function allocates an input buffer with kvzalloc to build flow group descriptors. When this allocation fails, the function releases the ft->g array with kfree and returns -ENOMEM without clearing the dangling pointer.

The only caller, arfs_create_table, propagates the error to mlx5e_arfs_create_tables, which routes cleanup through mlx5e_destroy_flow_table. That destroy path iterates ft->g and frees it again, producing a classic double-free on kernel heap memory. Exploitation depends on allocator state and adjacent slab objects at the time of failure.

Root Cause

The defect is an ownership and error-handling bug. arfs_create_groups frees a resource it does not exclusively own without nullifying the pointer or signaling to the caller that cleanup has already occurred. The caller assumes standard rollback semantics and repeats the free operation, violating the single-owner rule enforced for slab-allocated objects.

Attack Vector

Exploitation requires local access with low privileges on a system running the vulnerable mlx5_core driver with aRFS enabled. An attacker must induce a memory allocation failure in kvzalloc during flow table creation, typically by exhausting kernel memory or racing table initialization events. Successful triggering corrupts the SLUB allocator's freelist, which skilled attackers can shape into a use-after-free primitive for kernel code execution or privilege escalation.

No verified public proof-of-concept exists for this issue. The vulnerability is described in prose because no sanitized exploit code is available in the referenced advisories.

Detection Methods for CVE-2024-35835

Indicators of Compromise

Kernel oops or panic messages referencing arfs_create_groups, arfs_create_table, or mlx5e_destroy_flow_table in dmesg and /var/log/kern.log
SLUB debug warnings such as double free or corruption and KASAN: double-free in mlx5e when kernel address sanitizer is enabled
Unexpected mlx5 driver initialization failures accompanied by -ENOMEM return codes during interface bring-up

Detection Strategies

Enable CONFIG_SLUB_DEBUG and CONFIG_KASAN on test systems to catch double-free conditions in the mlx5e code path
Inventory kernel versions across the fleet and correlate against the patched commits listed in the kernel.org stable tree
Monitor for repeated interface flapping or aRFS reconfiguration attempts, which may indicate allocation-failure fuzzing

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on crash signatures involving mlx5e symbols
Track userspace processes attempting to stress kernel memory or manipulate ethtool ntuple and rx-flow-hash settings from unprivileged contexts
Baseline mlx5 driver load and unload events to identify anomalous reinitialization attempts

How to Mitigate CVE-2024-35835

Immediate Actions Required

Apply the upstream Linux kernel patches from the stable tree that fix the double-free in arfs_create_groups
Update Debian systems with the security packages announced in the Debian LTS advisories for June 2024
Restrict local shell access on systems using mlx5 network adapters until patching is complete

Patch Information

Fixes are available in the Linux stable tree via the following commits: 2501afe6c4c9, 3c6d5189246f, 42876db001bb, 66cc521a739c, b21db3f1ab79, c57ca114eb00, cf116d9c3c2a, and e3d3ed8c1529. Debian users should consult the Debian LTS Announcement #17 and Debian LTS Announcement #20 for package updates. The fix nullifies the freed pointer in arfs_create_groups and adjusts caller cleanup so mlx5e_destroy_flow_table no longer frees ft->g a second time.

Workarounds

Disable Accelerated Receive Flow Steering on affected interfaces using ethtool -K <iface> ntuple off where feasible
Unload the mlx5_core module on hosts that do not require Mellanox Ethernet functionality
Limit unprivileged local access and enforce resource limits to reduce the likelihood of triggering kernel allocation failures

bash

# Verify kernel version and disable aRFS as a temporary mitigation
uname -r
sudo ethtool -K eth0 ntuple off
sudo ethtool -k eth0 | grep ntuple