CVE-2024-35854: Linux Kernel Use-After-Free Vulnerability

CVE-2024-35854 Overview

CVE-2024-35854 is a use-after-free vulnerability [CWE-416] in the Linux kernel's mlxsw driver for Mellanox Spectrum switches. The flaw resides in the spectrum_acl_tcam subsystem, specifically in the rehash delayed work that migrates Access Control List (ACL) filters between Ternary Content-Addressable Memory (TCAM) regions. When a migration fails but leaves a non-negative credit count, the kernel incorrectly destroys the source region while filters still reference it. Debian also ships affected kernel packages. The upstream fix prevents region destruction when migration has not completed successfully.

Critical Impact
A local attacker with the ability to trigger ACL rehash operations on affected Mellanox Spectrum hardware can cause a use-after-free condition, potentially leading to kernel memory corruption and local privilege escalation.

Affected Products

Linux kernel versions up through 6.9-rc5, including 6.9-rc1 through 6.9-rc5
Debian Linux 10.0 (per Debian LTS advisory)
Systems using the mlxsw_spectrum driver with Mellanox Spectrum ASIC hardware

Discovery Timeline

2024-05-17 - CVE-2024-35854 published to the National Vulnerability Database
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2024-35854

Vulnerability Analysis

The defect lives in mlxsw_sp_acl_tcam_vregion_rehash_work, the delayed work handler responsible for migrating ACL filters between TCAM regions. Migrations are throttled by a credit system: the worker processes entries until it runs out of credits, then reschedules itself. The completion logic evaluates the remaining credit count to determine whether migration finished, and if the count is non-negative, it calls mlxsw_sp_acl_tcam_region_destroy to free the source region.

This assumption is unsafe. A non-negative credit count can also occur when migration aborts due to an error partway through. In that path, filters still reference the source region when the destroy function runs, causing subsequent access through functions such as mlxsw_sp_acl_ctcam_region_entry_remove to dereference freed slab memory. Kernel Address Sanitizer (KASAN) confirmed the flaw with a slab-use-after-free report during entry removal.

Root Cause

The root cause is conflating two distinct states, successful migration and failed migration, under the same credit-based signal. The rehash worker used credit count as a proxy for completion without checking whether the migration loop returned an error. As a result, the cleanup path could not distinguish between a region that was safe to free and a region that still held live filter references.

Attack Vector

Exploitation requires local privileges on a Linux host driving Mellanox Spectrum switch hardware through the mlxsw driver. An attacker able to install, modify, or churn ACL filter rules through tc or netlink can drive the ACL TCAM into repeated rehash cycles and race a failing migration against region destruction. The resulting use-after-free grants an attacker read or write access to freed kernel slab memory, which can be leveraged for kernel-mode code execution and privilege escalation.

No verified public exploit code is available for CVE-2024-35854. Technical details are documented in the upstream kernel commits and the KASAN report embedded in the advisory.

Detection Methods for CVE-2024-35854

Indicators of Compromise

KASAN reports referencing slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove or adjacent mlxsw_sp_acl_tcam_* functions
Kernel oops or panic messages originating from mlxsw_sp_acl_tcam_vregion_rehash_work in the mlxsw_core workqueue
Unexpected kernel crashes on switches or servers running the mlxsw_spectrum driver during heavy tc filter reconfiguration

Detection Strategies

Inventory Linux hosts running kernels 6.9-rc1 through 6.9-rc5 and cross-reference with hardware using the mlxsw driver via lsmod | grep mlxsw.
Ingest dmesg and /var/log/kern.log into a centralized log platform and alert on KASAN or oops traces containing mlxsw_sp_acl_tcam.
Track kernel package versions across the fleet against the fixed commit hashes published on git.kernel.org to identify unpatched systems.

Monitoring Recommendations

Monitor unprivileged process activity that manipulates tc filters or writes to netlink sockets used by the mlxsw driver.
Alert on repeated ACL rule churn on network devices, which could indicate an attempt to force rehash migrations.
Correlate kernel crash telemetry with subsequent process privilege changes to surface potential exploitation attempts.

How to Mitigate CVE-2024-35854

Immediate Actions Required

Upgrade to a Linux kernel that includes the upstream fix; the corrective commits are tracked as 311eeaa7b9e2, 4c89642ca47f, 54225988889, 813e2ab753a8, a02687044e12, a429a912d6c7, and e118e7ea24d1 on git.kernel.org.
Debian 10 (Buster LTS) users should apply the update announced in the Debian LTS Announcement.
Restrict local access on hosts controlling Mellanox Spectrum switches and audit which users can invoke tc or netlink ACL operations.

Patch Information

The upstream fix modifies the rehash worker to avoid destroying the source region when migration failed. Distribution kernels backported the change across supported stable branches. Reference the kernel.org stable commit tree for the authoritative patch and validate that the kernel package on each host contains the corresponding backport before returning systems to production.

Workarounds

If patching is not immediately possible, unload the mlxsw_spectrum module on systems that do not require it using modprobe -r mlxsw_spectrum.
Limit non-root users' ability to modify ACL filters by restricting CAP_NET_ADMIN and hardening sudo policies for tc and related tooling.
Reduce ACL churn on affected switches to minimize the frequency of rehash operations until a patched kernel is deployed.

bash

# Verify the running kernel and mlxsw driver status before and after patching
uname -r
lsmod | grep mlxsw
# Confirm the patched commit is present in the installed kernel source (Debian example)
apt-cache policy linux-image-$(uname -r)
# Optionally unload the driver where the hardware is not in use
sudo modprobe -r mlxsw_spectrum