CVE-2024-36007

Q: What is the severity of CVE-2024-36007?

CVE-2024-36007 has a CVSS score of 5.5 (MEDIUM). This vulnerability in the Linux kernel's mlxsw driver causes a kernel warning during Access Control List (ACL) rehashing operations. It affects systems using Mellanox network hardware with the mlxsw driver, potentially leading to system instability or denial of service. The issue occurs when the driver incorrectly handles migration markers during ACL filter rehashing.

5.5 MEDIUM

Denial of Service

📋 TL;DR

This vulnerability in the Linux kernel's mlxsw driver causes a kernel warning during Access Control List (ACL) rehashing operations. It affects systems using Mellanox network hardware with the mlxsw driver, potentially leading to system instability or denial of service. The issue occurs when the driver incorrectly handles migration markers during ACL filter rehashing.

💻 Affected Systems

Products:

Linux kernel with mlxsw driver

Versions: Linux kernel versions before fixes in stable releases (specific commits listed in references)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Mellanox network hardware using the mlxsw driver. Requires ACL functionality to be enabled and used.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to memory corruption from iterating over wrong data structures, causing complete system unavailability.

🟠

Likely Case

Kernel warning messages in system logs and potential disruption of network ACL functionality, leading to degraded network performance or temporary service interruption.

🟢

If Mitigated

Minor performance impact during ACL operations with warning messages logged but no service disruption.

🌐 Internet-Facing: LOW - This is a driver-level issue requiring local access to trigger, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Could be triggered by legitimate ACL operations or malicious local users, potentially causing service disruption.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access to trigger ACL operations. No known public exploits, but could be triggered by legitimate system operations or malicious local users.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits: 039992b6d2df097c65f480dcf269de3d2656f573, 0b88631855026b55cad901ac28d081e0f358e596, 17e9e0bbae652b9b2049e51699e93dfa60b2988d, 1d76bd2a0034d0d08045c1c6adf2235d88982952, 743edc8547a92b6192aa1f1b6bb78233fa21dc9b

Vendor Advisory: https://git.kernel.org/stable/c/039992b6d2df097c65f480dcf269de3d2656f573

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable ACL functionality

linux

Temporarily disable Access Control List features if not required, reducing chance of triggering the rehash operation.

# Check current ACL configuration
# Modify network configuration to avoid ACL operations

🧯 If You Can't Patch

Monitor system logs for kernel warnings related to mlxsw_afk_encode or ACL operations
Limit local user access to systems with Mellanox hardware to reduce potential trigger sources

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if mlxsw driver is loaded: 'uname -r' and 'lsmod | grep mlxsw'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and check system logs for absence of mlxsw_afk_encode warnings

📡 Detection & Monitoring

Log Indicators:

Kernel warnings containing 'mlxsw_afk_encode'
Warnings about ACL operations in system logs
Messages from mlxsw_sp_acl_tcam_vregion_rehash_work

Network Indicators:

Unusual network ACL rule changes
Network performance degradation on Mellanox interfaces

SIEM Query:

source="kernel" AND ("mlxsw_afk_encode" OR "WARNING" AND "mlxsw")

📊 Metadata

CVE ID: CVE-2024-36007

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published: May 20, 2024

Last Updated: December 17, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable ACL functionality

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export