CVE-2024-35852 is a vulnerability identified in the Linux kernel's mlxsw (Mellanox switch) driver, specifically within the spectrum_acl_tcam module that manages Access Control List (ACL) TCAM (Ternary Content Addressable Memory) rehash operations. The vulnerability arises from a memory leak caused by improper handling of delayed rehash work cancellation. The kernel schedules rehash work to migrate ACL regions, relying on a credit counter to determine if the migration has completed. However, after a prior fix addressing a use-after-free issue, the logic determining migration completion based on non-negative credits became unreliable. This can lead to a scenario where rehash work remains pending with associated 'hints' data structures allocated at the start of migration. If this work is canceled while still pending, the hints are not freed, resulting in a memory leak. The leak is evidenced by unreferenced kernel objects detected during runtime, as shown in the provided kernel backtrace. Although this vulnerability does not directly lead to code execution or privilege escalation, it can degrade system stability and reliability by exhausting kernel memory resources over time, especially in environments with frequent ACL rehash operations. The issue affects Linux kernel versions containing the specified commit hash and is resolved by ensuring that hints are freed when pending work is canceled. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2024-35852 primarily concerns network infrastructure stability and reliability. Organizations relying on Linux-based systems with Mellanox networking hardware or similar configurations that utilize the mlxsw driver for ACL management could experience gradual memory exhaustion due to the leak, potentially leading to degraded network performance or kernel crashes. This is particularly relevant for data centers, cloud providers, telecommunications companies, and enterprises with high network traffic and complex ACL policies. While the vulnerability does not directly compromise confidentiality or integrity, the availability of critical network services could be affected, causing operational disruptions. In sectors such as finance, healthcare, and critical infrastructure within Europe, even transient network outages can have significant regulatory and business consequences. The absence of known active exploitation reduces immediate risk, but the vulnerability warrants timely patching to prevent potential future abuse or inadvertent system failures.

To mitigate CVE-2024-35852, European organizations should: 1) Apply the latest Linux kernel patches that address this vulnerability as soon as they become available, ensuring the mlxsw driver includes the fix for proper freeing of hints during canceled rehash work. 2) Monitor kernel logs and system metrics for signs of memory leaks or unusual resource consumption related to ACL rehash operations, enabling early detection of potential exploitation or system degradation. 3) Implement strict change management and testing procedures for kernel updates in production environments to minimize downtime. 4) For environments where immediate patching is not feasible, consider temporarily reducing the frequency of ACL rehash operations or adjusting ACL configurations to limit triggering the vulnerable code path. 5) Engage with hardware vendors and Linux distribution maintainers to confirm the presence of the fix in vendor-supplied kernel versions and coordinate timely updates. 6) Maintain comprehensive backups and recovery plans to address potential system instability caused by kernel memory leaks.