CVE-2024-35835 (GCVE-0-2024-35835)
Vulnerability from cvelistv5
Published
2024-05-17 14:02
Modified
2026-08-05 11:30
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfs_create_groups When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c
Version: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c
Version: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c
Version: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c
Version: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c
Version: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c
Version: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c
Version: 1cabe6b0965ec067ac60e8f182f16d479a3b9a5c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35835",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T17:01:13.319923Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T21:08:42.977Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e3d3ed8c152971dbe64c92c9ecb98fdb52abb629",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "2501afe6c4c9829d03abe9a368b83d9ea1b611b7",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "c57ca114eb00e03274dd38108d07a3750fa3c056",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "42876db001bbea7558e8676d1019f08f9390addb",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "66cc521a739ccd5da057a1cb3d6346c6d0e7619b",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            },
            {
              "lessThan": "3c6d5189246f590e4e1f167991558bdb72a4738b",
              "status": "affected",
              "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.307",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.307",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.269",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.76",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix a double-free in arfs_create_groups\n\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\nft-\u003eg and return an error. However, arfs_create_table, the only caller of\narfs_create_groups, will hold this error and call to\nmlx5e_destroy_flow_table, in which the ft-\u003eg will be freed again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Every path into `arfs_create_groups()` is a local device-lifecycle event \u2014 `finit_module`/auxiliary-PCI probe or rebind, `_mlx5e_resume()`, a devlink `DEVLINK_CMD_ESWITCH_SET` profile change, VF representor attach, or IPoIB child-interface creation. No remote or adjacent peer data reaches this code, so the attacker must already be on the host.\nAC:L - The gating condition is a `kvzalloc(GFP_KERNEL)` failure, which a local attacker influences directly by driving system memory pressure, and the triggering events (eswitch mode toggles, driver rebind, IPoIB child creation, resume) are repeatable on demand. Once the allocation fails the double free is fully deterministic \u2014 there is no race and no memory layout the attacker cannot groom.\nPR:L - The initiating events themselves need administrative privilege (CAP_SYS_MODULE, or devlink\u0027s `GENL_ADMIN_PERM` checked against `init_user_ns`, not reachable via user namespaces), but the attacker-supplied half of the condition \u2014 the memory pressure that forces the `!in` error path \u2014 requires only an ordinary unprivileged local account running alongside routine administrative or power-management activity.\nUI:N - No victim action beyond ordinary system operation is required; the faulty cleanup executes automatically inside `arfs_create_table()` whenever the `in` allocation fails. The attacker supplies the memory pressure and simply waits for, or races with, normal driver/devlink activity.\nS:U - The corruption is confined to the host kernel\u0027s own slab allocator and the mlx5e driver\u0027s data structures, within a single security authority. No VM, IOMMU, or sandbox boundary is crossed by the defect.\nC:H - The doubly-freed `ft-\u003eg` is a 16-byte object in the shared `kmalloc-16` cache; under the memory pressure that caused the failure it is very likely reallocated between the two `kfree()` calls, so the second free leaves a live object on the freelist. The attacker can reclaim that aliased allocation and read back kernel memory belonging to another owner, giving uncontrolled information disclosure.\nI:H - Freelist aliasing from a double free lets two independent allocations own the same `kmalloc-16` chunk, so attacker-controlled bytes overwrite a live kernel object \u2014 a type-confusion/write primitive suitable for control-flow hijacking and privilege escalation. Corrupted SLUB freelist pointers additionally allow steering subsequent allocations to attacker-chosen addresses.\nA:H - Even without successful exploitation, the second `kfree()` of an already-freed pointer trips SLUB double-free/redzone detection or corrupts the freelist, producing a `BUG`, oops, or panic (fatal with `panic_on_warn`). This occurs in the network device bring-up path, taking the machine or its NIC down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:13.382Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629"
        },
        {
          "url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056"
        },
        {
          "url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b"
        }
      ],
      "title": "net/mlx5e: fix a double-free in arfs_create_groups",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35835",
    "datePublished": "2024-05-17T14:02:23.469Z",
    "dateReserved": "2024-05-17T13:50:33.103Z",
    "dateUpdated": "2026-08-05T11:30:13.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:48.621Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35835\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-17T17:01:13.319923Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:24.593Z\"}}], \"cna\": {\"title\": \"net/mlx5e: fix a double-free in arfs_create_groups\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Every path into `arfs_create_groups()` is a local device-lifecycle event \\u2014 `finit_module`/auxiliary-PCI probe or rebind, `_mlx5e_resume()`, a devlink `DEVLINK_CMD_ESWITCH_SET` profile change, VF representor attach, or IPoIB child-interface creation. No remote or adjacent peer data reaches this code, so the attacker must already be on the host.\\nAC:L - The gating condition is a `kvzalloc(GFP_KERNEL)` failure, which a local attacker influences directly by driving system memory pressure, and the triggering events (eswitch mode toggles, driver rebind, IPoIB child creation, resume) are repeatable on demand. Once the allocation fails the double free is fully deterministic \\u2014 there is no race and no memory layout the attacker cannot groom.\\nPR:L - The initiating events themselves need administrative privilege (CAP_SYS_MODULE, or devlink\u0027s `GENL_ADMIN_PERM` checked against `init_user_ns`, not reachable via user namespaces), but the attacker-supplied half of the condition \\u2014 the memory pressure that forces the `!in` error path \\u2014 requires only an ordinary unprivileged local account running alongside routine administrative or power-management activity.\\nUI:N - No victim action beyond ordinary system operation is required; the faulty cleanup executes automatically inside `arfs_create_table()` whenever the `in` allocation fails. The attacker supplies the memory pressure and simply waits for, or races with, normal driver/devlink activity.\\nS:U - The corruption is confined to the host kernel\u0027s own slab allocator and the mlx5e driver\u0027s data structures, within a single security authority. No VM, IOMMU, or sandbox boundary is crossed by the defect.\\nC:H - The doubly-freed `ft-\u003eg` is a 16-byte object in the shared `kmalloc-16` cache; under the memory pressure that caused the failure it is very likely reallocated between the two `kfree()` calls, so the second free leaves a live object on the freelist. The attacker can reclaim that aliased allocation and read back kernel memory belonging to another owner, giving uncontrolled information disclosure.\\nI:H - Freelist aliasing from a double free lets two independent allocations own the same `kmalloc-16` chunk, so attacker-controlled bytes overwrite a live kernel object \\u2014 a type-confusion/write primitive suitable for control-flow hijacking and privilege escalation. Corrupted SLUB freelist pointers additionally allow steering subsequent allocations to attacker-chosen addresses.\\nA:H - Even without successful exploitation, the second `kfree()` of an already-freed pointer trips SLUB double-free/redzone detection or corrupts the freelist, producing a `BUG`, oops, or panic (fatal with `panic_on_warn`). This occurs in the network device bring-up path, taking the machine or its NIC down.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"2501afe6c4c9829d03abe9a368b83d9ea1b611b7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"c57ca114eb00e03274dd38108d07a3750fa3c056\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"42876db001bbea7558e8676d1019f08f9390addb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"66cc521a739ccd5da057a1cb3d6346c6d0e7619b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1cabe6b0965ec067ac60e8f182f16d479a3b9a5c\", \"lessThan\": \"3c6d5189246f590e4e1f167991558bdb72a4738b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.307\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.269\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.210\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.76\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629\"}, {\"url\": \"https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7\"}, {\"url\": \"https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5\"}, {\"url\": \"https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056\"}, {\"url\": \"https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb\"}, {\"url\": \"https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7\"}, {\"url\": \"https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b\"}, {\"url\": \"https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: fix a double-free in arfs_create_groups\\n\\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\\nft-\u003eg and return an error. However, arfs_create_table, the only caller of\\narfs_create_groups, will hold this error and call to\\nmlx5e_destroy_flow_table, in which the ft-\u003eg will be freed again.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.307\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.269\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.210\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.76\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.15\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.3\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:13.382Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35835\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:13.382Z\", \"dateReserved\": \"2024-05-17T13:50:33.103Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T14:02:23.469Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.