CVE-2024-26586 is a vulnerability identified in the Linux kernel's mlxsw driver, specifically within the spectrum_acl_tcam component responsible for managing Access Control Lists (ACLs) in network devices. The vulnerability arises due to a mismatch between the firmware-reported maximum number of ACLs in a group and the actual hardware register layout (PAGT register) that configures these ACL groups. In Spectrum-2 and newer ASICs, the firmware reports support for more than 16 ACLs per group, but the PAGT register was not updated accordingly, leading to a scenario where exceeding 16 ACLs in a group causes stack corruption. This stack corruption manifests as a kernel panic triggered by the stack protector detecting corruption during ACL group updates, specifically in the function mlxsw_sp_acl_tcam_group_update. The issue occurs when traffic control (tc) filters are added to a network device, binding local ports to ACL groups that sequentially evaluate filters stored in different TCAM regions. The vulnerability is rare and triggered only when more than 16 ACLs are required in a group, which can happen when filters are added with decreasing priorities and alternating orders that prevent consecutive filters from fitting in the same TCAM region. The fix involves limiting the maximum ACL group size to the minimum of the firmware-reported maximum and the maximum supported by the PAGT register, preventing stack corruption. A test case was also added to ensure system stability when this condition is encountered. No known exploits are reported in the wild, and the vulnerability does not have an assigned CVSS score yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels on hardware using Spectrum-2 or newer ASICs with the mlxsw driver, commonly found in network infrastructure devices such as switches and routers. Exploitation could lead to kernel panics causing denial of service (DoS) conditions, disrupting network traffic and potentially impacting critical services reliant on stable network connectivity. While the vulnerability does not directly lead to privilege escalation or remote code execution, the resulting system crashes could affect availability and operational continuity. Organizations with complex network configurations using extensive ACLs may be more susceptible, especially in data centers, ISPs, and enterprises with advanced traffic filtering needs. The lack of known exploits reduces immediate risk, but the potential for DoS in critical network components necessitates prompt attention. Additionally, the vulnerability could complicate network management and troubleshooting, increasing operational overhead.

European organizations should apply the Linux kernel patches that address CVE-2024-26586 as soon as they become available from their Linux distribution vendors. In the interim, network administrators should audit their ACL configurations to ensure that no ACL group exceeds 16 entries, especially on devices using Spectrum-2 or newer ASICs with the mlxsw driver. Monitoring kernel logs for stack protector warnings or kernel panics related to mlxsw_sp_acl_tcam_group_update can help detect attempts to trigger the vulnerability. Network teams should also review traffic control filter deployment practices to avoid adding filters in decreasing priority orders that could cause excessive ACL group sizes. Where possible, segmenting network traffic and distributing ACLs across multiple groups or devices can reduce the risk of hitting the ACL group size limit. Finally, organizations should maintain up-to-date backups and have incident response plans ready to address potential network outages caused by this vulnerability.