External risk intelligence

Linux Kernel mlx5 Flow Rule Linking Crash Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2024-35960

This vulnerability is located deep within the Linux kernel networking stack, specifically involving flow steering rules in the mlx5 driver. It is not an internet-facing service or application. Access to this component requires local or privileged context, making it extremely unlikely to be directly reachable from the public internet in typical deployments.

Linux Kernel

4.10 to before 4.19.3134.20 to before 5.4.2755.5 to before 5.10.2165.11 to before 5.15.1565.16 to before 6.1.876.2 to before 6.6.286.7 to before 6.8.76.910.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Linux kernel's networking component that could lead to system crashes. This issue arises from how new networking rules are managed, and while it has been resolved, its original exploitation in the wild highlights potential risks in how duplicate network rules are handled. The main concern is to confirm if this specific kernel component is relevant to your environment.

Kernel flaw can cause system crashes.
Issue related to managing network rules.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could trigger this vulnerability by creating specific network flow rules that are handled incorrectly by the Linux kernel's networking component. This misbehavior can occur during the creation of flow rules, leading to a situation where a rule is referenced multiple times internally without being properly linked into the system's rule tree. When the system attempts to clean up these incorrectly linked rules, it can result in a crash.

Requires internal component interaction.
Triggered by creating duplicate flow rules.
Results in a denial-of-service crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the stability of systems running a vulnerable Linux kernel when flow rules are deleted. The issue arises from a specific race condition in how new flow rules are linked into the kernel's tree structure, potentially leading to a crash. There is no indication that system data, user data, or sensitive information is exposed by this vulnerability.

System stability.
Rule deletion leads to a crash.
Denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's networking component, specifically the mlx5 driver, is affected by this vulnerability. Infrastructure or platform teams responsible for managing kernel versions and network configurations are likely to own this issue. The first practical step is to identify all systems running the affected Linux kernel versions, determine their business criticality and network exposure, and then assign ownership for remediation.

Infrastructure/Platform teams own the issue.
Verify kernel versions and system criticality.
Plan remediation based on exposure and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel and the mlx5 driver mentioned in CVE-2024-35960?

The Linux kernel is the foundational software that manages hardware resources for an operating system. The mlx5 driver is a specific component within this kernel designed to support Mellanox networking hardware. This driver handles high-speed data flow and rule management, which are critical for network performance in data centers and enterprise environments.

How does CVE-2024-35960 cause a system crash?

This vulnerability involves a weakness class known as CWE-476, or NULL pointer dereference. The kernel incorrectly tracks network flow rules when duplicates are created, leaving some rules disconnected from the internal management tree. When the system later attempts to delete these orphaned rules, it references a missing parent, causing the kernel to crash and resulting in a denial-of-service.

Do I need to be worried about how this bug is triggered?

The flaw is triggered during the creation and subsequent deletion of specific network flow rules. It is not triggered by simple network traffic or standard connection attempts. It specifically requires the creation of conflicting flow rules that lead to internal reference counting errors, rather than being triggered by the content of incoming data packets themselves.

Is CVE-2024-35960 reachable from the internet?

According to Halo Surface Signal, it is very unlikely. The vulnerability exists deep within the kernel networking stack and is not an internet-facing application. Exploiting this requires interaction with specific internal driver components, making direct remote exploitation from the public internet extremely difficult in standard system configurations.

When should I prioritize fixing this Linux kernel vulnerability?

You should prioritize this by first auditing your environment to identify systems running the affected kernel versions. Because this issue affects system stability rather than data confidentiality, focus on high-availability infrastructure. Once identified, work with your platform team to schedule updates to a non-vulnerable kernel version as part of your standard maintenance cycle.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.