CVE-2024-49953 is a vulnerability in the Linux kernel's mlx5e network driver, specifically related to the handling of IPsec (Internet Protocol Security) states within the kernel's transform (xfrm) framework. The issue arises because the driver's delayed work does not properly check the state of the xfrm_state object before attempting to delete it. In particular, the function __xfrm_state_delete() can be called twice on the same state object due to a race condition between the xfrm timer and the driver's delayed work queue. When xfrm_state_check_expire() is invoked, it may reset the state to XFRM_STATE_EXPIRED even if the state is already XFRM_STATE_DEAD but not yet freed. This leads to a second call to __xfrm_state_delete(), which causes a kernel crash due to a general protection fault triggered by accessing invalid memory (non-canonical address). The crash manifests as an oops in the kernel logs, indicating a serious fault that can cause denial of service (DoS) by crashing the affected system or network interface. The root cause is a missing validation check on the km.state variable before proceeding with state expiration checks. The fix involves skipping the expiration check if the state is not valid (i.e., not XFRM_STATE_VALID), preventing the double deletion and subsequent crash. This vulnerability affects Linux kernel versions around 6.11.0-rc2+ and impacts systems using the mlx5e driver, which is commonly associated with Mellanox (now NVIDIA) network cards that support advanced networking features including IPsec offload. No known exploits are reported in the wild as of the publication date, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2024-49953 can be significant, particularly for enterprises and data centers relying on Linux servers with Mellanox network adapters for high-performance networking and IPsec-based secure communications. A successful exploitation leads to a kernel crash causing a denial of service, which can disrupt critical network services, VPN tunnels, and secure communications infrastructure. This can affect availability of services, potentially leading to operational downtime, loss of productivity, and impact on business continuity. Organizations using Linux-based firewalls, routers, or VPN gateways with vulnerable drivers are at risk of network outages. Although this vulnerability does not appear to allow privilege escalation or remote code execution directly, the induced kernel panic can be leveraged in targeted denial-of-service attacks, especially in environments with automated recovery or failover mechanisms that might be overwhelmed. Given the widespread use of Linux in European governmental, financial, and industrial sectors, the disruption of secure network channels could have cascading effects on sensitive data transmission and compliance with data protection regulations such as GDPR.

To mitigate this vulnerability, European organizations should prioritize updating their Linux kernels to versions where the patch for CVE-2024-49953 has been applied. Since the vulnerability is in the mlx5e driver, organizations should identify systems using Mellanox/NVIDIA network cards and verify kernel versions. If immediate kernel upgrades are not feasible, consider temporarily disabling IPsec offload features on affected network interfaces to avoid triggering the vulnerable code path. Network administrators should monitor kernel logs for signs of crashes related to __xfrm_state_delete and implement alerting for such events. Additionally, deploying kernel live patching solutions can reduce downtime by applying fixes without full reboots. Organizations should also review their incident response plans to handle potential denial-of-service incidents caused by this vulnerability. Finally, vendors and cloud providers should be engaged to confirm patch availability and deployment timelines for managed services.