mlxsw: spectrum_acl_tcam: Fix stack corruption

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2024-26586
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-02-22 17:15:08 UTC
Updated2026-08-04 11:16:45 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found. One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage. In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required. Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register. Add a test case to make sure the machine does not crash when this condition is hit. [1] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120 [...] dump_stack_lvl+0x36/0x50 panic+0x305/0x330 __stack_chk_fail+0x15/0x20 mlxsw_sp_acl_tcam_group_update+0x116/0x120 mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110 mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Risk And Classification

Primary CVSS: v3.1 6.7 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-787

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary6.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c3ab435466d5109b2c7525a3b90107d4d9e918fc 56750ea5d15426b5f307554e7699e8b5f76c3182 git Not specified
CNA Linux Linux affected c3ab435466d5109b2c7525a3b90107d4d9e918fc 348112522a35527c5bcba933b9fefb40a4f44f15 git Not specified
CNA Linux Linux affected c3ab435466d5109b2c7525a3b90107d4d9e918fc 6fd24675188d354b1cad47462969afa2ab09d819 git Not specified
CNA Linux Linux affected c3ab435466d5109b2c7525a3b90107d4d9e918fc 2f5e1565740490706332c06f36211d4ce0f88e62 git Not specified
CNA Linux Linux affected c3ab435466d5109b2c7525a3b90107d4d9e918fc a361c2c1da5dbb13ca67601cf961ab3ad68af383 git Not specified
CNA Linux Linux affected c3ab435466d5109b2c7525a3b90107d4d9e918fc 483ae90d8f976f8339cf81066312e1329f2d3706 git Not specified
CNA Linux Linux affected 4.19 Not specified
CNA Linux Linux unaffected 4.19 semver Not specified
CNA Linux Linux unaffected 5.10.209 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.148 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.79 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.14 6.6.* semver Not specified
CNA Linux Linux unaffected 6.7.2 6.7.* semver Not specified
CNA Linux Linux unaffected 6.8 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
mlxsw: spectrum_acl_tcam: Fix stack corruption - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
mlxsw: spectrum_acl_tcam: Fix stack corruption - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
mlxsw: spectrum_acl_tcam: Fix stack corruption - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2024/06/msg00016.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org
mlxsw: spectrum_acl_tcam: Fix stack corruption - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
mlxsw: spectrum_acl_tcam: Fix stack corruption - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
mlxsw: spectrum_acl_tcam: Fix stack corruption - kernel/git/stable/linux.git - Linux kernel stable tree af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 200243 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6725-1)
  • 6000567 Debian Security Update for linux (DSA 5658-1)
  • 755965 SUSE Enterprise Linux Security Update for the linux kernel (SUSE-SU-2024:0858-1)
  • 755966 SUSE Enterprise Linux Security Update for the linux kernel (SUSE-SU-2024:0857-1)
  • 756004 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2024:0926-1)
  • 756010 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2024:0977-1)

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report