CVE-2024-35835

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-35835", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.103Z", "datePublished": "2024-05-17T14:02:23.469Z", "dateUpdated": "2026-08-05T11:30:13.382Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:13.382Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix a double-free in arfs_create_groups\n\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\nft->g and return an error. However, arfs_create_table, the only caller of\narfs_create_groups, will hold this error and call to\nmlx5e_destroy_flow_table, in which the ft->g will be freed again."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Every path into `arfs_create_groups()` is a local device-lifecycle event \u2014 `finit_module`/auxiliary-PCI probe or rebind, `_mlx5e_resume()`, a devlink `DEVLINK_CMD_ESWITCH_SET` profile change, VF representor attach, or IPoIB child-interface creation. No remote or adjacent peer data reaches this code, so the attacker must already be on the host.\nAC:L - The gating condition is a `kvzalloc(GFP_KERNEL)` failure, which a local attacker influences directly by driving system memory pressure, and the triggering events (eswitch mode toggles, driver rebind, IPoIB child creation, resume) are repeatable on demand. Once the allocation fails the double free is fully deterministic \u2014 there is no race and no memory layout the attacker cannot groom.\nPR:L - The initiating events themselves need administrative privilege (CAP_SYS_MODULE, or devlink's `GENL_ADMIN_PERM` checked against `init_user_ns`, not reachable via user namespaces), but the attacker-supplied half of the condition \u2014 the memory pressure that forces the `!in` error path \u2014 requires only an ordinary unprivileged local account running alongside routine administrative or power-management activity.\nUI:N - No victim action beyond ordinary system operation is required; the faulty cleanup executes automatically inside `arfs_create_table()` whenever the `in` allocation fails. The attacker supplies the memory pressure and simply waits for, or races with, normal driver/devlink activity.\nS:U - The corruption is confined to the host kernel's own slab allocator and the mlx5e driver's data structures, within a single security authority. No VM, IOMMU, or sandbox boundary is crossed by the defect.\nC:H - The doubly-freed `ft->g` is a 16-byte object in the shared `kmalloc-16` cache; under the memory pressure that caused the failure it is very likely reallocated between the two `kfree()` calls, so the second free leaves a live object on the freelist. The attacker can reclaim that aliased allocation and read back kernel memory belonging to another owner, giving uncontrolled information disclosure.\nI:H - Freelist aliasing from a double free lets two independent allocations own the same `kmalloc-16` chunk, so attacker-controlled bytes overwrite a live kernel object \u2014 a type-confusion/write primitive suitable for control-flow hijacking and privilege escalation. Corrupted SLUB freelist pointers additionally allow steering subsequent allocations to attacker-chosen addresses.\nA:H - Even without successful exploitation, the second `kfree()` of an already-freed pointer trips SLUB double-free/redzone detection or corrupts the freelist, producing a `BUG`, oops, or panic (fatal with `panic_on_warn`). This occurs in the network device bring-up path, taking the machine or its NIC down."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"], "versions": [{"version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "e3d3ed8c152971dbe64c92c9ecb98fdb52abb629", "status": "affected", "versionType": "git"}, {"version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "2501afe6c4c9829d03abe9a368b83d9ea1b611b7", "status": "affected", "versionType": "git"}, {"version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5", "status": "affected", "versionType": "git"}, {"version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "c57ca114eb00e03274dd38108d07a3750fa3c056", "status": "affected", "versionType": "git"}, {"version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "42876db001bbea7558e8676d1019f08f9390addb", "status": "affected", "versionType": "git"}, {"version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7", "status": "affected", "versionType": "git"}, {"version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "66cc521a739ccd5da057a1cb3d6346c6d0e7619b", "status": "affected", "versionType": "git"}, {"version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "3c6d5189246f590e4e1f167991558bdb72a4738b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.307", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.269", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.210", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.149", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.76", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.15", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.3", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "4.19.307"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.4.269"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.10.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.15.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.76"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629"}, {"url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7"}, {"url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5"}, {"url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056"}, {"url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb"}, {"url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7"}, {"url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b"}, {"url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b"}], "title": "net/mlx5e: fix a double-free in arfs_create_groups", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-17T17:01:13.319923Z", "id": "CVE-2024-35835", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-06T21:08:42.977Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.621Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.621Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-35835", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-17T17:01:13.319923Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:24.593Z"}}], "cna": {"title": "net/mlx5e: fix a double-free in arfs_create_groups", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Every path into `arfs_create_groups()` is a local device-lifecycle event \u2014 `finit_module`/auxiliary-PCI probe or rebind, `_mlx5e_resume()`, a devlink `DEVLINK_CMD_ESWITCH_SET` profile change, VF representor attach, or IPoIB child-interface creation. No remote or adjacent peer data reaches this code, so the attacker must already be on the host.\nAC:L - The gating condition is a `kvzalloc(GFP_KERNEL)` failure, which a local attacker influences directly by driving system memory pressure, and the triggering events (eswitch mode toggles, driver rebind, IPoIB child creation, resume) are repeatable on demand. Once the allocation fails the double free is fully deterministic \u2014 there is no race and no memory layout the attacker cannot groom.\nPR:L - The initiating events themselves need administrative privilege (CAP_SYS_MODULE, or devlink's `GENL_ADMIN_PERM` checked against `init_user_ns`, not reachable via user namespaces), but the attacker-supplied half of the condition \u2014 the memory pressure that forces the `!in` error path \u2014 requires only an ordinary unprivileged local account running alongside routine administrative or power-management activity.\nUI:N - No victim action beyond ordinary system operation is required; the faulty cleanup executes automatically inside `arfs_create_table()` whenever the `in` allocation fails. The attacker supplies the memory pressure and simply waits for, or races with, normal driver/devlink activity.\nS:U - The corruption is confined to the host kernel's own slab allocator and the mlx5e driver's data structures, within a single security authority. No VM, IOMMU, or sandbox boundary is crossed by the defect.\nC:H - The doubly-freed `ft->g` is a 16-byte object in the shared `kmalloc-16` cache; under the memory pressure that caused the failure it is very likely reallocated between the two `kfree()` calls, so the second free leaves a live object on the freelist. The attacker can reclaim that aliased allocation and read back kernel memory belonging to another owner, giving uncontrolled information disclosure.\nI:H - Freelist aliasing from a double free lets two independent allocations own the same `kmalloc-16` chunk, so attacker-controlled bytes overwrite a live kernel object \u2014 a type-confusion/write primitive suitable for control-flow hijacking and privilege escalation. Corrupted SLUB freelist pointers additionally allow steering subsequent allocations to attacker-chosen addresses.\nA:H - Even without successful exploitation, the second `kfree()` of an already-freed pointer trips SLUB double-free/redzone detection or corrupts the freelist, producing a `BUG`, oops, or panic (fatal with `panic_on_warn`). This occurs in the network device bring-up path, taking the machine or its NIC down."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "e3d3ed8c152971dbe64c92c9ecb98fdb52abb629", "versionType": "git"}, {"status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "2501afe6c4c9829d03abe9a368b83d9ea1b611b7", "versionType": "git"}, {"status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5", "versionType": "git"}, {"status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "c57ca114eb00e03274dd38108d07a3750fa3c056", "versionType": "git"}, {"status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "42876db001bbea7558e8676d1019f08f9390addb", "versionType": "git"}, {"status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7", "versionType": "git"}, {"status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "66cc521a739ccd5da057a1cb3d6346c6d0e7619b", "versionType": "git"}, {"status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "lessThan": "3c6d5189246f590e4e1f167991558bdb72a4738b", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"status": "unaffected", "version": "0", "lessThan": "4.7", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.307", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.269", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.210", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.149", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.76", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.15", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.3", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629"}, {"url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7"}, {"url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5"}, {"url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056"}, {"url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb"}, {"url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7"}, {"url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b"}, {"url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix a double-free in arfs_create_groups\n\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\nft->g and return an error. However, arfs_create_table, the only caller of\narfs_create_groups, will hold this error and call to\nmlx5e_destroy_flow_table, in which the ft->g will be freed again."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.307", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.269", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.210", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.149", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.76", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.15", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.3", "versionStartIncluding": "4.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "4.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:13.382Z"}}}, "cveMetadata": {"cveId": "CVE-2024-35835", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:30:13.382Z", "dateReserved": "2024-05-17T13:50:33.103Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T14:02:23.469Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e3d3ed8c152971dbe64c92c9ecb98fdb52abb629", "status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "versionType": "git"}, {"lessThan": "2501afe6c4c9829d03abe9a368b83d9ea1b611b7", "status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "versionType": "git"}, {"lessThan": "cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5", "status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "versionType": "git"}, {"lessThan": "c57ca114eb00e03274dd38108d07a3750fa3c056", "status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "versionType": "git"}, {"lessThan": "42876db001bbea7558e8676d1019f08f9390addb", "status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "versionType": "git"}, {"lessThan": "b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7", "status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "versionType": "git"}, {"lessThan": "66cc521a739ccd5da057a1cb3d6346c6d0e7619b", "status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "versionType": "git"}, {"lessThan": "3c6d5189246f590e4e1f167991558bdb72a4738b", "status": "affected", "version": "1cabe6b0965ec067ac60e8f182f16d479a3b9a5c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.307", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.269", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.210", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.149", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.76", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.15", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EF343E15-B245-411F-8FE3-B09AFCCC3B50", "versionEndExcluding": "4.19.307", "versionStartIncluding": "4.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "319545F3-D56C-4751-BEBF-0505478BBAE8", "versionEndExcluding": "5.4.269", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5CB4CA6-A9A0-4AFD-9102-8CF94D708170", "versionEndExcluding": "5.10.210", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0D0465BB-4053-4E15-9137-6696EBAE90FD", "versionEndExcluding": "5.15.149", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "32F0FEB3-5FE1-4400-A56D-886F09BE872E", "versionEndExcluding": "6.1.76", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "87C718CB-AE3D-4B07-B4D9-BFF64183C468", "versionEndExcluding": "6.6.15", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "58FD5308-148A-40D3-B36A-0CA6B434A8BF", "versionEndExcluding": "6.7.3", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: fix a double-free in arfs_create_groups\n\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\nft->g and return an error. However, arfs_create_table, the only caller of\narfs_create_groups, will hold this error and call to\nmlx5e_destroy_flow_table, in which the ft->g will be freed again."}, {"lang": "es", "value": " En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net/mlx5e: corregido un double free en arfs_create_groups Cuando falla `in` asignado por kvzalloc, arfs_create_groups liberar\u00e1 ft->g y devolver\u00e1 un error. Sin embargo, arfs_create_table, el \u00fanico llamador de arfs_create_groups, mantendr\u00e1 este error y llamar\u00e1 a mlx5e_destroy_flow_table, en el que ft->g se liberar\u00e1 nuevamente."}], "id": "CVE-2024-35835", "lastModified": "2026-08-04T11:17:57.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-35835", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-05-17T17:01:13.319923Z", "version": "2.0.3"}}]}, "published": "2024-05-17T14:15:20.387", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:4352", "cpe": "cpe:/a:redhat:enterprise_linux:8::nfv", "package": "kernel-rt-0:4.18.0-553.8.1.rt7.349.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-07-08T00:00:00Z"}, {"advisory": "RHSA-2024:4211", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "kernel-0:4.18.0-553.8.1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-07-02T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2025:3021", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "kernel-0:5.14.0-427.60.1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-03-19T00:00:00Z"}], "bugzilla": {"description": "kernel: net/mlx5e: fix a double-free in arfs_create_groups", "id": "2281165", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281165"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/mlx5e: fix a double-free in arfs_create_groups\nWhen `in` allocated by kvzalloc fails, arfs_create_groups will free\nft->g and return an error. However, arfs_create_table, the only caller of\narfs_create_groups, will hold this error and call to\nmlx5e_destroy_flow_table, in which the ft->g will be freed again.", "A double-free vulnerability was found in the `arfs_create_groups` function in the Linux kernel's `net/mlx5e` driver. This issue could lead to memory corruption or a system crash if exploited, as freeing the same memory twice may cause undefined behavior."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-35835", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-35835\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-35835\nhttps://lore.kernel.org/linux-cve-announce/2024051730-CVE-2024-35835-d75f@gregkh/T"], "threat_severity": "Moderate"}

{}