{"id":"CVE-2024-35960","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Properly link new fs rules into the tree\n\nPreviously, add_rule_fg would only add newly created rules from the\nhandle into the tree when they had a refcount of…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Properly link new fs rules into the tree\n\nPreviously, add_rule_fg would only add newly created rules from the\nhandle into the tree when they had a refcount of…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.10, < 4.19.313","linux_kernel >= 4.20, < 5.4.275","linux_kernel >= 5.5, < 5.10.216","linux_kernel >= 5.11, < 5.15.156","linux_kernel >= 5.16, < 6.1.87","linux_kernel >= 6.2, < 6.6.28","linux_kernel >= 6.7, < 6.8.7","linux_kernel = 6.9","debian_linux = 10.0"],"patched":["linux_kernel 6.8.7"],"published":"2024-05-20","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:17:55.733","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-35960","references":[{"url":"https://git.kernel.org/stable/c/1263b0b26077b1183c3c45a0a2479573a351d423","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e8dc5cffc844dacfa79f056dea88002312f253f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d90ca9145f6b97b38d0c2b6b30f6ca6af9c1801","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5cf5337ef701830f173b4eec00a4f984adeb57a0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7aaee12b804c5e0374e7b132b6ec2158ff33dd64","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c6782ad4911cbee874e85630226ed389ff2e453","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/adf67a03af39095f05d82050f15813d6f700159d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de0139719cdda82806a47580ca0df06fc85e0bd2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1263b0b26077b1183c3c45a0a2479573a351d423","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/2e8dc5cffc844dacfa79f056dea88002312f253f","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/3d90ca9145f6b97b38d0c2b6b30f6ca6af9c1801","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/5cf5337ef701830f173b4eec00a4f984adeb57a0","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/7aaee12b804c5e0374e7b132b6ec2158ff33dd64","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/7c6782ad4911cbee874e85630226ed389ff2e453","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/adf67a03af39095f05d82050f15813d6f700159d","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/de0139719cdda82806a47580ca0df06fc85e0bd2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.01413,"epssPercentile":0.72572,"ingestedAt":"2026-10-15T03:30:12.692Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2025-01-16T21:09:41.022641Z"},"slug":"CVE-2024-35960","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Properly link new fs rules into the tree\n\nPreviously, add_rule_fg would only add newly created rules from the\nhandle into the tree when they had a refcount of 1. On the other hand,\ncreate_flow_handle tries hard to find and reference already existing\nidentical rules instead of creating new ones.\n\nThese two behaviors can result in a situation where create_flow_handle\n1) creates a new rule and references it, then\n2) in a subsequent step during the same handle creation references it\n   again,\nresulting in a rule with a refcount of 2 that is not linked into the\ntree, will have a NULL parent and root and will result in a crash when\nthe flow group is deleted because del_sw_hw_rule, invoked on rule\ndeletion, assumes node->parent is != NULL.\n\nThis happened in the wild, due to another bug related to incorrect\nhandling of duplicate pkt_reformat ids, which lead to the code in\ncreate_flow_handle incorrectly referencing a just-added rule in the same\nflow handle, resulting in the problem described above. Full details are\nat [1].\n\nThis patch changes add_rule_fg to add new rules without parents into\nthe tree, properly initializing them and avoiding the crash. This makes\nit more consistent with how rules are added to an FTE in\ncreate_flow_handle.\n\n## Affected\n\n- `linux_kernel >= 4.10, < 4.19.313`\n- `linux_kernel >= 4.20, < 5.4.275`\n- `linux_kernel >= 5.5, < 5.10.216`\n- `linux_kernel >= 5.11, < 5.15.156`\n- `linux_kernel >= 5.16, < 6.1.87`\n- `linux_kernel >= 6.2, < 6.6.28`\n- `linux_kernel >= 6.7, < 6.8.7`\n- `linux_kernel = 6.9`\n- `debian_linux = 10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.8.7`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}