CVE-2024-35960

CVE-2024-35960 is a vulnerability in the Linux kernel's Mellanox MLX5 driver that affects flow steering rule handling. When identical rules are created and referenced multiple times, they can fail to properly link into the rule tree, leaving them uninitialized. This can cause system crashes during rule deletion due to invalid references. The issue has been fixed by ensuring all newly created rules are properly initialized and linked. Updating to a patched kernel version resolves the problem and ensures system stability.

This vulnerability is rated as Moderate because exploitation requires local access and is restricted to systems utilizing Mellanox ConnectX network hardware driven by the mlx5 module. Improper tracking of duplicate flow steering entries leaves them unlinked, triggering a NULL pointer dereference and kernel crash when the associated flow group is removed. The impact is confined to a denial of service without compromising confidentiality or system integrity, and environments without active Mellanox hardware remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.