CVE-2024-35853 is a vulnerability identified in the Linux kernel, specifically within the mlxsw driver component responsible for managing Spectrum switch ACL (Access Control List) TCAM (Ternary Content-Addressable Memory) regions. The issue arises during the rehashing process, which is a delayed work task that migrates filters (rules) from one region to another to maintain ACL functionality. The vulnerability is caused by improper handling of rollback operations when a migration fails. The code attempts to revert filters back to the original region if migration fails, but if this rollback itself fails, the code erroneously attempts another migration, creating a 'ping pong' effect. This leads to a memory leak because the virtual chunk structure references two chunks: the currently used chunk and a backup chunk. The code assumes the backup chunk is NULL if the current chunk does not reference the target region, but this assumption breaks during a rollback of a rollback, causing the backup chunk to be overwritten and leaked. This flaw can cause resource exhaustion and potential instability in the kernel module managing ACLs. The vulnerability has been fixed by preventing rollback of a failed rollback and adding warnings to avoid future similar cases. The issue was observed on Linux kernel version 6.9.0-rc2 with Mellanox Technologies hardware, but it may affect other versions using the mlxsw driver. The CVSS score is 6.4 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability (primarily availability). No known exploits are reported in the wild yet.

For European organizations, this vulnerability could impact any infrastructure relying on Linux systems with Mellanox Spectrum switches or similar hardware using the mlxsw driver for ACL management. The memory leak and instability caused by this vulnerability could lead to degraded network performance, denial of service, or system crashes affecting critical network functions. This is particularly relevant for data centers, cloud providers, telecom operators, and enterprises with high network traffic and complex ACL configurations. The disruption could affect availability of network services and potentially lead to increased operational costs due to troubleshooting and downtime. Although the vulnerability does not directly allow privilege escalation or remote code execution, the denial of service impact on network infrastructure could have cascading effects on business continuity and service delivery in sectors such as finance, healthcare, and government services across Europe.

Organizations should promptly apply the Linux kernel patches that address this vulnerability once available from their Linux distribution vendors. Specifically, updating to a kernel version that includes the fix preventing rollback of a failed rollback in the mlxsw driver is critical. Network administrators should audit their use of Spectrum ACL TCAM features and monitor kernel logs for related warnings or errors indicating potential exploitation or instability. Implementing kernel live patching where supported can reduce downtime during patch deployment. Additionally, organizations should consider isolating critical network functions on hardware or virtual machines not affected by this vulnerability until patches are applied. Regularly reviewing and testing ACL configurations to minimize complex rehash operations can reduce exposure. Finally, maintaining robust monitoring and alerting on network device health and performance will help detect early signs of issues related to this vulnerability.