CVE-2024-35854 is a high-severity use-after-free vulnerability in the Linux kernel's mlxsw (Mellanox switch) driver, specifically within the spectrum_acl_tcam component responsible for managing Access Control List (ACL) filters in TCAM (Ternary Content-Addressable Memory). The vulnerability arises during the rehashing process, which migrates ACL filters from one TCAM region to another based on available credits. The flawed logic assumes that a non-negative credit count indicates successful migration, leading to the destruction of the source region. However, this assumption is incorrect because a non-negative credit count can also result from a failed migration. Consequently, the source region may be destroyed while still being referenced by filters, causing a use-after-free condition. This can lead to kernel memory corruption, crashes, or potentially arbitrary code execution within kernel space. The issue was detected through Kernel Address Sanitizer (KASAN) reports, showing slab-use-after-free errors during region entry removal. The vulnerability affects Linux kernel versions including the 6.9.0-rc2 release candidate and likely other versions using the affected mlxsw driver. Exploitation requires local privileges (PR:L) but no user interaction (UI:N) and can be performed remotely over the network (AV:N) due to the nature of the mlxsw driver handling network traffic. The CVSS v3.1 score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. No known exploits are currently reported in the wild. The fix involves correcting the logic to avoid destroying TCAM regions if migration fails, preventing use-after-free conditions.

For European organizations, this vulnerability poses significant risks, especially for enterprises and data centers relying on Linux-based network infrastructure utilizing Mellanox hardware or compatible switches. The mlxsw driver is commonly used in high-performance networking environments, including cloud providers, telecom operators, and large-scale data centers prevalent across Europe. Successful exploitation could allow attackers with local access or network-level access to cause kernel crashes, leading to denial of service, or potentially escalate privileges to execute arbitrary code in kernel space, compromising system confidentiality and integrity. This could disrupt critical services, impact data privacy, and undermine trust in network security. Given the widespread use of Linux in European IT environments and the strategic importance of telecommunications and cloud infrastructure, the vulnerability could have cascading effects on service availability and data protection compliance under regulations like GDPR.

European organizations should prioritize applying the official Linux kernel patches that address CVE-2024-35854 as soon as they become available. Until patches are deployed, organizations should: 1) Restrict access to systems running vulnerable Linux kernels with mlxsw drivers to trusted personnel only, minimizing local privilege escalation risks. 2) Monitor kernel logs and system behavior for signs of use-after-free errors or crashes related to mlxsw components. 3) Employ kernel hardening techniques such as Kernel Address Sanitizer (KASAN) in testing environments to detect similar issues proactively. 4) For network devices using Mellanox hardware, coordinate with vendors for firmware and driver updates. 5) Implement network segmentation to limit exposure of vulnerable systems to untrusted networks. 6) Conduct thorough vulnerability scanning and asset inventory to identify affected systems accurately. 7) Develop incident response plans specific to kernel-level compromises to ensure rapid containment and recovery.