CVE-2024-50252 is a vulnerability identified in the Linux kernel, specifically within the Mellanox Spectrum mlxsw driver handling IPv6 GRE (ip6gre) tunnel devices. The issue arises when changing the remote IPv6 address of an ip6gre network device. The driver manages IPv6 addresses used for encapsulation in linear memory. However, when the remote address is changed, the new address is not properly added to the driver's hash table, and the old address is not removed. This results in a memory leak and a warning message logged by the kernel. The root cause is that the driver's internal data structures do not correctly update the reference counts and hash table entries for the IPv6 addresses during reconfiguration of the ip6gre device. The vulnerability was reproducible by creating an ip6gre device with a specific local and remote IPv6 address, changing the remote address, and then deleting the device, which triggers the leak. The kernel logs a warning indicating the failure to properly release the old IPv6 address object, which remains unreferenced in memory. The issue affects Linux kernel versions prior to the fix commit referenced and is specific to the mlxsw Spectrum driver used in Mellanox/NVIDIA network hardware. While the vulnerability does not directly cause a crash or remote code execution, the memory leak could lead to resource exhaustion on affected systems if the remote address is changed repeatedly without reboot or driver reload. This could degrade network device performance or stability over time. No known exploits are reported in the wild as of the publication date. The fix involves correctly programming the new IPv6 address into the driver's hash table and removing the old one, ensuring proper reference counting and memory management when the ip6gre device configuration changes.

For European organizations, this vulnerability primarily impacts systems running Linux kernels with the affected mlxsw Spectrum driver, commonly found in data centers, cloud infrastructure, and enterprise networks utilizing Mellanox/NVIDIA network adapters. The memory leak could lead to gradual resource depletion on critical network devices, potentially causing degraded network performance or device instability. This is particularly relevant for organizations relying on IPv6 GRE tunnels for secure or segmented network traffic, such as telecom providers, cloud service operators, and large enterprises with complex network topologies. While the vulnerability does not enable direct remote code execution or privilege escalation, the resulting instability could disrupt network services, impacting availability and operational continuity. Organizations with high network traffic volumes or frequent reconfiguration of ip6gre tunnels are at greater risk of encountering the leak's effects. Additionally, the warning messages logged by the kernel could complicate troubleshooting and mask other critical issues. Given the widespread use of Linux in European IT infrastructure and the increasing adoption of IPv6, this vulnerability poses a moderate operational risk if left unpatched.

European organizations should apply the official Linux kernel patches that address CVE-2024-50252 as soon as they become available in their distribution's stable releases. Until patched, administrators should minimize changes to the remote IPv6 addresses of ip6gre devices on systems using the mlxsw Spectrum driver to reduce the risk of memory leaks. Monitoring kernel logs for warnings related to mlxsw_sp_ipv6_addr_put can help detect attempts to exploit or trigger the issue. Network teams should audit their use of IPv6 GRE tunnels and consider alternative tunneling mechanisms if frequent reconfiguration is required. For critical infrastructure, implementing automated kernel update processes and testing patches in staging environments will ensure timely remediation. Additionally, organizations should maintain robust resource monitoring on network devices to detect abnormal memory usage trends that could indicate leaks. Collaboration with hardware vendors to confirm driver versions and firmware compatibility is recommended to ensure comprehensive mitigation.