CVE-2024-36007 is a medium severity vulnerability in the Linux kernel specifically affecting the mlxsw (Mellanox switch) driver component, which handles ACL (Access Control List) TCAM (Ternary Content Addressable Memory) operations. The vulnerability arises from improper handling of internal markers during the rehashing process of ACL filters. The rehash operation migrates filters between regions by iterating over chunks (groups of filters with the same priority) and their entries. When the rehash work is interrupted due to resource constraints (running out of credits), it stores markers to resume later. However, upon encountering an error, the chunk marker is reset to NULL but the entry markers, which are relative to the chunk, are not reset accordingly. This inconsistency can cause the rehash process to resume from an invalid entry that does not belong to the current chunk, leading to the chunk being incorrectly treated as an entry. While this does not cause kernel address sanitizer (KASAN) crashes, it triggers kernel warnings and could potentially destabilize the kernel's network stack. The issue is rooted in the mlxsw_afk_encode function and related ACL TCAM rehash workqueue processing. The fix involves resetting all markers consistently and adding safeguards to prevent future occurrences. The vulnerability requires local privileges with low complexity and no user interaction, impacting availability but not confidentiality or integrity. It affects Linux kernel versions containing the specified commit hashes prior to the fix and is relevant for systems using Mellanox network hardware with the mlxsw driver, commonly found in data centers and enterprise networking environments.

For European organizations, this vulnerability primarily threatens the availability and stability of Linux-based systems utilizing Mellanox network hardware, which is prevalent in high-performance computing, cloud infrastructure, and enterprise data centers. Disruptions caused by kernel warnings and potential rehash failures could lead to degraded network performance, intermittent connectivity issues, or kernel panics requiring system reboots. This can impact critical services, especially in sectors relying on low-latency and high-throughput networking such as finance, telecommunications, research institutions, and cloud service providers. Although the vulnerability does not expose data confidentiality or integrity directly, the availability impact can cause operational downtime and service interruptions. Given the medium CVSS score and the requirement for local privileges, exploitation is less likely from external attackers but remains a concern for insider threats or compromised accounts. The absence of known exploits in the wild reduces immediate risk but patching is essential to maintain network reliability and prevent potential escalation or chaining with other vulnerabilities.

European organizations should prioritize updating their Linux kernels to versions that include the patch for CVE-2024-36007 as soon as it becomes available. Since the vulnerability affects the mlxsw driver, organizations using Mellanox network devices should verify their kernel versions and apply vendor-specific updates or patches. Network administrators should monitor kernel logs for warnings related to mlxsw_afk_encode or ACL TCAM rehash operations as early indicators of potential issues. Implement strict access controls to limit local user privileges, reducing the risk of exploitation by unauthorized users. For environments where immediate patching is not feasible, consider isolating affected systems or limiting access to trusted personnel. Additionally, coordinate with Mellanox hardware vendors for firmware updates or configuration recommendations that might mitigate risk. Regularly audit network device drivers and kernel modules to ensure they are up to date and configured securely. Finally, incorporate this vulnerability into incident response plans to quickly address any availability issues arising from this flaw.