CVE-2024-35835 (GCVE-0-2024-35835)

Vulnerability from cvelistv5 – Published: 2024-05-17 14:02 – Updated: 2026-08-05 11:30
VLAI
Title
net/mlx5e: fix a double-free in arfs_create_groups
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfs_create_groups When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c , < e3d3ed8c152971dbe64c92c9ecb98fdb52abb629 (git)
Affected: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c , < 2501afe6c4c9829d03abe9a368b83d9ea1b611b7 (git)
Affected: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c , < cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5 (git)
Affected: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c , < c57ca114eb00e03274dd38108d07a3750fa3c056 (git)
Affected: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c , < 42876db001bbea7558e8676d1019f08f9390addb (git)
Affected: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c , < b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7 (git)
Affected: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c , < 66cc521a739ccd5da057a1cb3d6346c6d0e7619b (git)
Affected: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c , < 3c6d5189246f590e4e1f167991558bdb72a4738b (git)
Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 4.19.307 , ≤ 4.19.* (semver)
Unaffected: 5.4.269 , ≤ 5.4.* (semver)
Unaffected: 5.10.210 , ≤ 5.10.* (semver)
Unaffected: 5.15.149 , ≤ 5.15.* (semver)
Unaffected: 6.1.76 , ≤ 6.1.* (semver)
Unaffected: 6.6.15 , ≤ 6.6.* (semver)
Unaffected: 6.7.3 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35835",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T17:01:13.319923Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T21:08:42.977Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e3d3ed8c152971dbe64c92c9ecb98fdb52abb629",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "2501afe6c4c9829d03abe9a368b83d9ea1b611b7",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "c57ca114eb00e03274dd38108d07a3750fa3c056",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "42876db001bbea7558e8676d1019f08f9390addb",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "66cc521a739ccd5da057a1cb3d6346c6d0e7619b",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "3c6d5189246f590e4e1f167991558bdb72a4738b",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.307",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.307",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.269",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.76",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix a double-free in arfs_create_groups\n\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\nft-\u003eg and return an error. However, arfs_create_table, the only caller of\narfs_create_groups, will hold this error and call to\nmlx5e_destroy_flow_table, in which the ft-\u003eg will be freed again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Every path into `arfs_create_groups()` is a local device-lifecycle event \u2014 `finit_module`/auxiliary-PCI probe or rebind, `_mlx5e_resume()`, a devlink `DEVLINK_CMD_ESWITCH_SET` profile change, VF representor attach, or IPoIB child-interface creation. No remote or adjacent peer data reaches this code, so the attacker must already be on the host.\nAC:L - The gating condition is a `kvzalloc(GFP_KERNEL)` failure, which a local attacker influences directly by driving system memory pressure, and the triggering events (eswitch mode toggles, driver rebind, IPoIB child creation, resume) are repeatable on demand. Once the allocation fails the double free is fully deterministic \u2014 there is no race and no memory layout the attacker cannot groom.\nPR:L - The initiating events themselves need administrative privilege (CAP_SYS_MODULE, or devlink\u0027s `GENL_ADMIN_PERM` checked against `init_user_ns`, not reachable via user namespaces), but the attacker-supplied half of the condition \u2014 the memory pressure that forces the `!in` error path \u2014 requires only an ordinary unprivileged local account running alongside routine administrative or power-management activity.\nUI:N - No victim action beyond ordinary system operation is required; the faulty cleanup executes automatically inside `arfs_create_table()` whenever the `in` allocation fails. The attacker supplies the memory pressure and simply waits for, or races with, normal driver/devlink activity.\nS:U - The corruption is confined to the host kernel\u0027s own slab allocator and the mlx5e driver\u0027s data structures, within a single security authority. No VM, IOMMU, or sandbox boundary is crossed by the defect.\nC:H - The doubly-freed `ft-\u003eg` is a 16-byte object in the shared `kmalloc-16` cache; under the memory pressure that caused the failure it is very likely reallocated between the two `kfree()` calls, so the second free leaves a live object on the freelist. The attacker can reclaim that aliased allocation and read back kernel memory belonging to another owner, giving uncontrolled information disclosure.\nI:H - Freelist aliasing from a double free lets two independent allocations own the same `kmalloc-16` chunk, so attacker-controlled bytes overwrite a live kernel object \u2014 a type-confusion/write primitive suitable for control-flow hijacking and privilege escalation. Corrupted SLUB freelist pointers additionally allow steering subsequent allocations to attacker-chosen addresses.\nA:H - Even without successful exploitation, the second `kfree()` of an already-freed pointer trips SLUB double-free/redzone detection or corrupts the freelist, producing a `BUG`, oops, or panic (fatal with `panic_on_warn`). This occurs in the network device bring-up path, taking the machine or its NIC down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:13.382Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629"
        },
        {
          "url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056"
        },
        {
          "url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b"
        }
      ],
      "title": "net/mlx5e: fix a double-free in arfs_create_groups",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35835",
    "datePublished": "2024-05-17T14:02:23.469Z",
    "dateReserved": "2024-05-17T13:50:33.103Z",
    "dateUpdated": "2026-08-05T11:30:13.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35835",
      "date": "2026-08-05",
      "epss": "0.00668",
      "percentile": "0.48386"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: fix a double-free in arfs_create_groups\\n\\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\\nft-\u003eg and return an error. However, arfs_create_table, the only caller of\\narfs_create_groups, will hold this error and call to\\nmlx5e_destroy_flow_table, in which the ft-\u003eg will be freed again.\"}, {\"lang\": \"es\", \"value\": \" En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: net/mlx5e: corregido un double free en arfs_create_groups Cuando falla `in` asignado por kvzalloc, arfs_create_groups liberar\\u00e1 ft-\u0026gt;g y devolver\\u00e1 un error. Sin embargo, arfs_create_table, el \\u00fanico llamador de arfs_create_groups, mantendr\\u00e1 este error y llamar\\u00e1 a mlx5e_destroy_flow_table, en el que ft-\u0026gt;g se liberar\\u00e1 nuevamente.\"}]",
      "id": "CVE-2024-35835",
      "lastModified": "2024-11-21T09:21:00.503",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2024-05-17T14:15:20.387",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35835\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:20.387\",\"lastModified\":\"2026-08-04T11:17:57.567\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: fix a double-free in arfs_create_groups\\n\\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\\nft-\u003eg and return an error. However, arfs_create_table, the only caller of\\narfs_create_groups, will hold this error and call to\\nmlx5e_destroy_flow_table, in which the ft-\u003eg will be freed again.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net/mlx5e: corregido un double free en arfs_create_groups Cuando falla `in` asignado por kvzalloc, arfs_create_groups liberar\u00e1 ft-\u0026gt;g y devolver\u00e1 un error. Sin embargo, arfs_create_table, el \u00fanico llamador de arfs_create_groups, mantendr\u00e1 este error y llamar\u00e1 a mlx5e_destroy_flow_table, en el que ft-\u0026gt;g se liberar\u00e1 nuevamente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\",\"lessThan\":\"e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\",\"lessThan\":\"2501afe6c4c9829d03abe9a368b83d9ea1b611b7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\",\"lessThan\":\"cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\",\"lessThan\":\"c57ca114eb00e03274dd38108d07a3750fa3c056\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\",\"lessThan\":\"42876db001bbea7558e8676d1019f08f9390addb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\",\"lessThan\":\"b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\",\"lessThan\":\"66cc521a739ccd5da057a1cb3d6346c6d0e7619b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\",\"lessThan\":\"3c6d5189246f590e4e1f167991558bdb72a4738b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.307\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.269\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.210\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.149\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.76\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.15\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.3\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-17T17:01:13.319923Z\",\"id\":\"CVE-2024-35835\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.7\",\"versionEndExcluding\":\"4.19.307\",\"matchCriteriaId\":\"EF343E15-B245-411F-8FE3-B09AFCCC3B50\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.269\",\"matchCriteriaId\":\"319545F3-D56C-4751-BEBF-0505478BBAE8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.210\",\"matchCriteriaId\":\"F5CB4CA6-A9A0-4AFD-9102-8CF94D708170\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.149\",\"matchCriteriaId\":\"0D0465BB-4053-4E15-9137-6696EBAE90FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.76\",\"matchCriteriaId\":\"32F0FEB3-5FE1-4400-A56D-886F09BE872E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.15\",\"matchCriteriaId\":\"87C718CB-AE3D-4B07-B4D9-BFF64183C468\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.3\",\"matchCriteriaId\":\"58FD5308-148A-40D3-B36A-0CA6B434A8BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:02:58+00:00",
      "cve": "CVE-2024-35835",
      "id": "CVE-2024-35835",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "30",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: fix a double-free in arfs_create_groups",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35835.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:59:13Z",
      "cve": "CVE-2024-35835",
      "id": "CVE-2024-35835",
      "initial_release_date": "2024-05-21T02:00:00Z",
      "product_status:known_affected": "436",
      "product_status:known_not_affected": "10",
      "product_status:recommended": "764",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35835",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35835.json",
      "version": "118"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.621Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35835\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-17T17:01:13.319923Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.593Z\"}}], \"cna\": {\"title\": \"net/mlx5e: fix a double-free in arfs_create_groups\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Every path into `arfs_create_groups()` is a local device-lifecycle event \\u2014 `finit_module`/auxiliary-PCI probe or rebind, `_mlx5e_resume()`, a devlink `DEVLINK_CMD_ESWITCH_SET` profile change, VF representor attach, or IPoIB child-interface creation. No remote or adjacent peer data reaches this code, so the attacker must already be on the host.\\nAC:L - The gating condition is a `kvzalloc(GFP_KERNEL)` failure, which a local attacker influences directly by driving system memory pressure, and the triggering events (eswitch mode toggles, driver rebind, IPoIB child creation, resume) are repeatable on demand. Once the allocation fails the double free is fully deterministic \\u2014 there is no race and no memory layout the attacker cannot groom.\\nPR:L - The initiating events themselves need administrative privilege (CAP_SYS_MODULE, or devlink\u0027s `GENL_ADMIN_PERM` checked against `init_user_ns`, not reachable via user namespaces), but the attacker-supplied half of the condition \\u2014 the memory pressure that forces the `!in` error path \\u2014 requires only an ordinary unprivileged local account running alongside routine administrative or power-management activity.\\nUI:N - No victim action beyond ordinary system operation is required; the faulty cleanup executes automatically inside `arfs_create_table()` whenever the `in` allocation fails. The attacker supplies the memory pressure and simply waits for, or races with, normal driver/devlink activity.\\nS:U - The corruption is confined to the host kernel\u0027s own slab allocator and the mlx5e driver\u0027s data structures, within a single security authority. No VM, IOMMU, or sandbox boundary is crossed by the defect.\\nC:H - The doubly-freed `ft-\u003eg` is a 16-byte object in the shared `kmalloc-16` cache; under the memory pressure that caused the failure it is very likely reallocated between the two `kfree()` calls, so the second free leaves a live object on the freelist. The attacker can reclaim that aliased allocation and read back kernel memory belonging to another owner, giving uncontrolled information disclosure.\\nI:H - Freelist aliasing from a double free lets two independent allocations own the same `kmalloc-16` chunk, so attacker-controlled bytes overwrite a live kernel object \\u2014 a type-confusion/write primitive suitable for control-flow hijacking and privilege escalation. Corrupted SLUB freelist pointers additionally allow steering subsequent allocations to attacker-chosen addresses.\\nA:H - Even without successful exploitation, the second `kfree()` of an already-freed pointer trips SLUB double-free/redzone detection or corrupts the freelist, producing a `BUG`, oops, or panic (fatal with `panic_on_warn`). This occurs in the network device bring-up path, taking the machine or its NIC down.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"2501afe6c4c9829d03abe9a368b83d9ea1b611b7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"c57ca114eb00e03274dd38108d07a3750fa3c056\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"42876db001bbea7558e8676d1019f08f9390addb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"66cc521a739ccd5da057a1cb3d6346c6d0e7619b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"3c6d5189246f590e4e1f167991558bdb72a4738b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.307\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.210\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.76\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\"}, {\"url\": \"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7\"}, {\"url\": \"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\"}, {\"url\": \"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056\"}, {\"url\": \"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb\"}, {\"url\": \"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\"}, {\"url\": \"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b\"}, {\"url\": \"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: fix a double-free in arfs_create_groups\\n\\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\\nft-\u003eg and return an error. However, arfs_create_table, the only caller of\\narfs_create_groups, will hold this error and call to\\nmlx5e_destroy_flow_table, in which the ft-\u003eg will be freed again.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.307\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.269\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.210\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.76\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.15\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.3\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:13.382Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35835\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:13.382Z\", \"dateReserved\": \"2024-05-17T13:50:33.103Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T14:02:23.469Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.