GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26595 (GCVE-0-2024-26595)

Vulnerability from cvelistv5 – Published: 2024-02-23 14:46 – Updated: 2026-05-11 20:00
VLAI
Title
mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path
Summary
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-23 16:34 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 22a677661f5624539d394f681276171f92d714df , < 75fa2d8b3c0175b519c99ace54ab8474cfd0077e (git)
Affected: 22a677661f5624539d394f681276171f92d714df , < 817840d125a370626895df269c50c923b79b0a39 (git)
Affected: 22a677661f5624539d394f681276171f92d714df , < d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f (git)
Affected: 22a677661f5624539d394f681276171f92d714df , < efeb7dfea8ee10cdec11b6b6ba4e405edbe75809 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.14 , ≤ 6.6.* (semver)
Unaffected: 6.7.2 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26595",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-23T16:34:10.081634Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:25.879Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:36:56.580Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "75fa2d8b3c0175b519c99ace54ab8474cfd0077e",
              "status": "affected",
              "version": "22a677661f5624539d394f681276171f92d714df",
              "versionType": "git"
            },
            {
              "lessThan": "817840d125a370626895df269c50c923b79b0a39",
              "status": "affected",
              "version": "22a677661f5624539d394f681276171f92d714df",
              "versionType": "git"
            },
            {
              "lessThan": "d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f",
              "status": "affected",
              "version": "22a677661f5624539d394f681276171f92d714df",
              "versionType": "git"
            },
            {
              "lessThan": "efeb7dfea8ee10cdec11b6b6ba4e405edbe75809",
              "status": "affected",
              "version": "22a677661f5624539d394f681276171f92d714df",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path\n\nWhen calling mlxsw_sp_acl_tcam_region_destroy() from an error path after\nfailing to attach the region to an ACL group, we hit a NULL pointer\ndereference upon \u0027region-\u003egroup-\u003etcam\u0027 [1].\n\nFix by retrieving the \u0027tcam\u0027 pointer using mlxsw_sp_acl_to_tcam().\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\nRIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0\n[...]\nCall Trace:\n mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20\n mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0\n mlxsw_sp_acl_rule_add+0x47/0x240\n mlxsw_sp_flower_replace+0x1a9/0x1d0\n tc_setup_cb_add+0xdc/0x1c0\n fl_hw_replace_filter+0x146/0x1f0\n fl_change+0xc17/0x1360\n tc_new_tfilter+0x472/0xb90\n rtnetlink_rcv_msg+0x313/0x3b0\n netlink_rcv_skb+0x58/0x100\n netlink_unicast+0x244/0x390\n netlink_sendmsg+0x1e4/0x440\n ____sys_sendmsg+0x164/0x260\n ___sys_sendmsg+0x9a/0xe0\n __sys_sendmsg+0x7a/0xc0\n do_syscall_64+0x40/0xe0\n entry_SYSCALL_64_after_hwframe+0x63/0x6b"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:00:26.122Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/75fa2d8b3c0175b519c99ace54ab8474cfd0077e"
        },
        {
          "url": "https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809"
        }
      ],
      "title": "mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26595",
    "datePublished": "2024-02-23T14:46:24.767Z",
    "dateReserved": "2024-02-19T14:20:24.127Z",
    "dateUpdated": "2026-05-11T20:00:26.122Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26595",
      "date": "2026-09-19",
      "epss": "0.0023",
      "percentile": "0.14051"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3FE97FF0-A9B6-4327-98DC-6EC1764E8142",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "4.11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0EA3778C-730B-464C-8023-18CA6AC0B807",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "6.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path\n\nWhen calling mlxsw_sp_acl_tcam_region_destroy() from an error path after\nfailing to attach the region to an ACL group, we hit a NULL pointer\ndereference upon \u0027region-\u003egroup-\u003etcam\u0027 [1].\n\nFix by retrieving the \u0027tcam\u0027 pointer using mlxsw_sp_acl_to_tcam().\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\nRIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0\n[...]\nCall Trace:\n mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20\n mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0\n mlxsw_sp_acl_rule_add+0x47/0x240\n mlxsw_sp_flower_replace+0x1a9/0x1d0\n tc_setup_cb_add+0xdc/0x1c0\n fl_hw_replace_filter+0x146/0x1f0\n fl_change+0xc17/0x1360\n tc_new_tfilter+0x472/0xb90\n rtnetlink_rcv_msg+0x313/0x3b0\n netlink_rcv_skb+0x58/0x100\n netlink_unicast+0x244/0x390\n netlink_sendmsg+0x1e4/0x440\n ____sys_sendmsg+0x164/0x260\n ___sys_sendmsg+0x9a/0xe0\n __sys_sendmsg+0x7a/0xc0\n do_syscall_64+0x40/0xe0\n entry_SYSCALL_64_after_hwframe+0x63/0x6b"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: mlxsw: espectro_acl_tcam: corrige la desreferencia del puntero NULL en la ruta de error Al llamar a mlxsw_sp_acl_tcam_region_destroy() desde una ruta de error despu\u00e9s de no poder adjuntar la regi\u00f3n a un grupo de ACL, alcanzamos una desreferencia del puntero NULL al \u0027regi\u00f3n-\u0026gt;grupo-\u0026gt;tcam\u0027 [1]. Solucione recuperando el puntero \u0027tcam\u0027 usando mlxsw_sp_acl_to_tcam(). [1] ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Seguimiento de llamadas: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0 x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b 0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 Entry_SYSCALL_64_after_hwframe+0x63/0x6b"
        }
      ],
      "id": "CVE-2024-26595",
      "lastModified": "2024-12-14T21:15:17.770",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-02-23T15:15:09.443",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/75fa2d8b3c0175b519c99ace54ab8474cfd0077e"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-476"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "75fa2d8b3c0175b519c99ace54ab8474cfd0077e",
                    "status": "affected",
                    "version": "22a677661f5624539d394f681276171f92d714df",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "817840d125a370626895df269c50c923b79b0a39",
                    "status": "affected",
                    "version": "22a677661f5624539d394f681276171f92d714df",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f",
                    "status": "affected",
                    "version": "22a677661f5624539d394f681276171f92d714df",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "efeb7dfea8ee10cdec11b6b6ba4e405edbe75809",
                    "status": "affected",
                    "version": "22a677661f5624539d394f681276171f92d714df",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.11"
                  },
                  {
                    "lessThan": "4.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.120",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3FE97FF0-A9B6-4327-98DC-6EC1764E8142",
                    "versionEndExcluding": "6.6.14",
                    "versionStartIncluding": "4.11.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0EA3778C-730B-464C-8023-18CA6AC0B807",
                    "versionEndExcluding": "6.7.2",
                    "versionStartIncluding": "6.7.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path\n\nWhen calling mlxsw_sp_acl_tcam_region_destroy() from an error path after\nfailing to attach the region to an ACL group, we hit a NULL pointer\ndereference upon \u0027region-\u003egroup-\u003etcam\u0027 [1].\n\nFix by retrieving the \u0027tcam\u0027 pointer using mlxsw_sp_acl_to_tcam().\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\nRIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0\n[...]\nCall Trace:\n mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20\n mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0\n mlxsw_sp_acl_rule_add+0x47/0x240\n mlxsw_sp_flower_replace+0x1a9/0x1d0\n tc_setup_cb_add+0xdc/0x1c0\n fl_hw_replace_filter+0x146/0x1f0\n fl_change+0xc17/0x1360\n tc_new_tfilter+0x472/0xb90\n rtnetlink_rcv_msg+0x313/0x3b0\n netlink_rcv_skb+0x58/0x100\n netlink_unicast+0x244/0x390\n netlink_sendmsg+0x1e4/0x440\n ____sys_sendmsg+0x164/0x260\n ___sys_sendmsg+0x9a/0xe0\n __sys_sendmsg+0x7a/0xc0\n do_syscall_64+0x40/0xe0\n entry_SYSCALL_64_after_hwframe+0x63/0x6b"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: mlxsw: espectro_acl_tcam: corrige la desreferencia del puntero NULL en la ruta de error Al llamar a mlxsw_sp_acl_tcam_region_destroy() desde una ruta de error despu\u00e9s de no poder adjuntar la regi\u00f3n a un grupo de ACL, alcanzamos una desreferencia del puntero NULL al \u0027regi\u00f3n-\u0026gt;grupo-\u0026gt;tcam\u0027 [1]. Solucione recuperando el puntero \u0027tcam\u0027 usando mlxsw_sp_acl_to_tcam(). [1] ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Seguimiento de llamadas: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0 x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b 0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 Entry_SYSCALL_64_after_hwframe+0x63/0x6b"
          }
        ],
        "id": "CVE-2024-26595",
        "lastModified": "2026-06-17T07:17:51.137",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-26595",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-23T16:34:10.081634Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-23T15:15:09.443",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/75fa2d8b3c0175b519c99ace54ab8474cfd0077e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T08:02:48+00:00",
      "cve": "CVE-2024-26595",
      "id": "CVE-2024-26595",
      "initial_release_date": "2024-02-23T00:00:00+00:00",
      "product_status:fixed": "150",
      "product_status:known_affected": "150",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26595.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-21T01:39:44Z",
      "cve": "CVE-2024-26595",
      "id": "CVE-2024-26595",
      "initial_release_date": "2024-02-27T03:54:43Z",
      "product_status:known_affected": "303",
      "product_status:known_not_affected": "90",
      "product_status:recommended": "950",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26595",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26595.json",
      "version": "69"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T20:36:56.580Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-26595",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-02-23T16:34:10.081634Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:13.076Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "75fa2d8b3c0175b519c99ace54ab8474cfd0077e",
                  "status": "affected",
                  "version": "22a677661f5624539d394f681276171f92d714df",
                  "versionType": "git"
                },
                {
                  "lessThan": "817840d125a370626895df269c50c923b79b0a39",
                  "status": "affected",
                  "version": "22a677661f5624539d394f681276171f92d714df",
                  "versionType": "git"
                },
                {
                  "lessThan": "d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f",
                  "status": "affected",
                  "version": "22a677661f5624539d394f681276171f92d714df",
                  "versionType": "git"
                },
                {
                  "lessThan": "efeb7dfea8ee10cdec11b6b6ba4e405edbe75809",
                  "status": "affected",
                  "version": "22a677661f5624539d394f681276171f92d714df",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.11"
                },
                {
                  "lessThan": "4.11",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.120",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.14",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.8",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.120",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.14",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.2",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8",
                      "versionStartIncluding": "4.11",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path\n\nWhen calling mlxsw_sp_acl_tcam_region_destroy() from an error path after\nfailing to attach the region to an ACL group, we hit a NULL pointer\ndereference upon \u0027region-\u003egroup-\u003etcam\u0027 [1].\n\nFix by retrieving the \u0027tcam\u0027 pointer using mlxsw_sp_acl_to_tcam().\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\nRIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0\n[...]\nCall Trace:\n mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20\n mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0\n mlxsw_sp_acl_rule_add+0x47/0x240\n mlxsw_sp_flower_replace+0x1a9/0x1d0\n tc_setup_cb_add+0xdc/0x1c0\n fl_hw_replace_filter+0x146/0x1f0\n fl_change+0xc17/0x1360\n tc_new_tfilter+0x472/0xb90\n rtnetlink_rcv_msg+0x313/0x3b0\n netlink_rcv_skb+0x58/0x100\n netlink_unicast+0x244/0x390\n netlink_sendmsg+0x1e4/0x440\n ____sys_sendmsg+0x164/0x260\n ___sys_sendmsg+0x9a/0xe0\n __sys_sendmsg+0x7a/0xc0\n do_syscall_64+0x40/0xe0\n entry_SYSCALL_64_after_hwframe+0x63/0x6b"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T20:00:26.122Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/75fa2d8b3c0175b519c99ace54ab8474cfd0077e"
            },
            {
              "url": "https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39"
            },
            {
              "url": "https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f"
            },
            {
              "url": "https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809"
            }
          ],
          "title": "mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-26595",
        "datePublished": "2024-02-23T14:46:24.767Z",
        "dateReserved": "2024-02-19T14:20:24.127Z",
        "dateUpdated": "2026-05-11T20:00:26.122Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.