CVE-2024-57801 (GCVE-0-2024-57801)

Vulnerability from cvelistv5 – Published: 2025-01-15 13:10 – Updated: 2026-08-05 11:46
VLAI
Title
net/mlx5e: Skip restore TC rules for vport rep without loaded flag
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Skip restore TC rules for vport rep without loaded flag During driver unload, unregister_netdev is called after unloading vport rep. So, the mlx5e_rep_priv is already freed while trying to get rpriv->netdev, or walk rpriv->tc_ht, which results in use-after-free. So add the checking to make sure access the data of vport rep which is still loaded.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-11 15:41 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d1569537a837d66620aa7ffc2bddf918e902f227 , < 3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0 (git)
Affected: d1569537a837d66620aa7ffc2bddf918e902f227 , < 47c78d3fc26e38ab805613a0f592dc8a820c7c64 (git)
Affected: d1569537a837d66620aa7ffc2bddf918e902f227 , < 5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.9 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-57801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:41:06.687224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:20.073Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0",
              "status": "affected",
              "version": "d1569537a837d66620aa7ffc2bddf918e902f227",
              "versionType": "git"
            },
            {
              "lessThan": "47c78d3fc26e38ab805613a0f592dc8a820c7c64",
              "status": "affected",
              "version": "d1569537a837d66620aa7ffc2bddf918e902f227",
              "versionType": "git"
            },
            {
              "lessThan": "5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be",
              "status": "affected",
              "version": "d1569537a837d66620aa7ffc2bddf918e902f227",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch.h",
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Skip restore TC rules for vport rep without loaded flag\n\nDuring driver unload, unregister_netdev is called after unloading\nvport rep. So, the mlx5e_rep_priv is already freed while trying to get\nrpriv-\u003enetdev, or walk rpriv-\u003etc_ht, which results in use-after-free.\nSo add the checking to make sure access the data of vport rep which is\nstill loaded."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is only reachable through local device configuration \u2014 XFRM/netlink IPsec offload state and policy deletion, SR-IOV/SF vport reconfiguration, or devlink/driver unload. No remote peer input reaches `mlx5_esw_ipsec_restore_dest_uplink()`.\nAC:L - This is not a race: `rep-\u003erep_data[REP_ETH].priv` is left permanently dangling after any vport rep unload, and the attacker independently controls when the last eswitch IPsec TX rule is removed to trigger the walk. Freshly freed kmalloc memory retains a non-NULL `rpriv-\u003enetdev`, so the old guard reliably fails to catch the freed object, and both required kconfigs are default-y.\nPR:L - Triggering requires network-device administration (CAP_NET_ADMIN for XFRM offload state/policy and SR-IOV/SF vport changes) rather than real root, and consistent with kernel.org CNA scoring of comparable mlx5 eswitch/flow-steering UAFs this is treated as a low-privileged local capability.\nUI:N - The vport rep unload and the subsequent IPsec TX flow-table refcount drop are both performed by the attacker; no action by any other user or victim is needed.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The freed `mlx5e_rep_priv` is read back (`rpriv-\u003enetdev`, `rpriv-\u003etc_ht`, `tc_ht.tbl`) and the walk then dereferences reclaimed-slab contents as `mlx5e_tc_flow` objects, so a heap-spray of the freed object yields an attacker-directed kernel read primitive.\nI:H - `rhashtable_walk_enter()` writes into the freed object (spinlock acquire) and performs `list_add()` through a `tbl` pointer read out of freed memory, giving a write through an attacker-influenceable pointer; the walk additionally programs hardware flow-rule destinations from bogus flow structures.\nA:H - Even without exploitation, walking a freed rhashtable dereferences garbage bucket-table pointers and causes an immediate kernel oops/panic, and the dangling rep pointer makes the crash reproducible on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:35.806Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/47c78d3fc26e38ab805613a0f592dc8a820c7c64"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be"
        }
      ],
      "title": "net/mlx5e: Skip restore TC rules for vport rep without loaded flag",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57801",
    "datePublished": "2025-01-15T13:10:24.619Z",
    "dateReserved": "2025-01-15T13:08:59.741Z",
    "dateUpdated": "2026-08-05T11:46:35.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57801",
      "date": "2026-08-13",
      "epss": "0.00223",
      "percentile": "0.13069"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:18:39.000Z",
      "cve": "CVE-2024-57801",
      "id": "msrc_CVE-2024-57801",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/mlx5e: Skip restore TC rules for vport rep without loaded flag",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-57801.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-57801\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-15T13:15:11.713\",\"lastModified\":\"2026-06-17T08:14:03.957\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Skip restore TC rules for vport rep without loaded flag\\n\\nDuring driver unload, unregister_netdev is called after unloading\\nvport rep. So, the mlx5e_rep_priv is already freed while trying to get\\nrpriv-\u003enetdev, or walk rpriv-\u003etc_ht, which results in use-after-free.\\nSo add the checking to make sure access the data of vport rep which is\\nstill loaded.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: Omitir reglas de restauraci\u00f3n de TC para vport rep sin indicador cargado Durante la descarga del controlador, se llama a unregister_netdev despu\u00e9s de descargar vport rep. Por lo tanto, mlx5e_rep_priv ya est\u00e1 liberado al intentar obtener rpriv-\u0026gt;netdev, o recorrer rpriv-\u0026gt;tc_ht, lo que da como resultado un use-after-free. Por lo tanto, agregue la verificaci\u00f3n para asegurarse de acceder a los datos de vport rep que a\u00fan est\u00e1n cargados.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c\",\"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\",\"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d1569537a837d66620aa7ffc2bddf918e902f227\",\"lessThan\":\"3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d1569537a837d66620aa7ffc2bddf918e902f227\",\"lessThan\":\"47c78d3fc26e38ab805613a0f592dc8a820c7c64\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d1569537a837d66620aa7ffc2bddf918e902f227\",\"lessThan\":\"5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c\",\"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\",\"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.70\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.9\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-11T15:41:06.687224Z\",\"id\":\"CVE-2024-57801\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.70\",\"matchCriteriaId\":\"3F383705-0C10-4CCE-8DE9-98985B5C8BC2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.9\",\"matchCriteriaId\":\"1D13AF97-FFED-4B68-906D-CFE38D0B88DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/47c78d3fc26e38ab805613a0f592dc8a820c7c64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2025-11-21T13:55:55+00:00",
      "cve": "CVE-2024-57801",
      "id": "CVE-2024-57801",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: Skip restore TC rules for vport rep without loaded flag",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57801.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:14:55Z",
      "cve": "CVE-2024-57801",
      "id": "CVE-2024-57801",
      "initial_release_date": "2025-01-16T03:49:42Z",
      "product_status:known_affected": "410",
      "product_status:known_not_affected": "308",
      "product_status:recommended": "363",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-57801",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-57801.json",
      "version": "62"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-57801\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T15:41:06.687224Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T15:41:08.156Z\"}}], \"cna\": {\"title\": \"net/mlx5e: Skip restore TC rules for vport rep without loaded flag\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is only reachable through local device configuration \\u2014 XFRM/netlink IPsec offload state and policy deletion, SR-IOV/SF vport reconfiguration, or devlink/driver unload. No remote peer input reaches `mlx5_esw_ipsec_restore_dest_uplink()`.\\nAC:L - This is not a race: `rep-\u003erep_data[REP_ETH].priv` is left permanently dangling after any vport rep unload, and the attacker independently controls when the last eswitch IPsec TX rule is removed to trigger the walk. Freshly freed kmalloc memory retains a non-NULL `rpriv-\u003enetdev`, so the old guard reliably fails to catch the freed object, and both required kconfigs are default-y.\\nPR:L - Triggering requires network-device administration (CAP_NET_ADMIN for XFRM offload state/policy and SR-IOV/SF vport changes) rather than real root, and consistent with kernel.org CNA scoring of comparable mlx5 eswitch/flow-steering UAFs this is treated as a low-privileged local capability.\\nUI:N - The vport rep unload and the subsequent IPsec TX flow-table refcount drop are both performed by the attacker; no action by any other user or victim is needed.\\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\\nC:H - The freed `mlx5e_rep_priv` is read back (`rpriv-\u003enetdev`, `rpriv-\u003etc_ht`, `tc_ht.tbl`) and the walk then dereferences reclaimed-slab contents as `mlx5e_tc_flow` objects, so a heap-spray of the freed object yields an attacker-directed kernel read primitive.\\nI:H - `rhashtable_walk_enter()` writes into the freed object (spinlock acquire) and performs `list_add()` through a `tbl` pointer read out of freed memory, giving a write through an attacker-influenceable pointer; the walk additionally programs hardware flow-rule destinations from bogus flow structures.\\nA:H - Even without exploitation, walking a freed rhashtable dereferences garbage bucket-table pointers and causes an immediate kernel oops/panic, and the dangling rep pointer makes the crash reproducible on demand.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d1569537a837d66620aa7ffc2bddf918e902f227\", \"lessThan\": \"3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d1569537a837d66620aa7ffc2bddf918e902f227\", \"lessThan\": \"47c78d3fc26e38ab805613a0f592dc8a820c7c64\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d1569537a837d66620aa7ffc2bddf918e902f227\", \"lessThan\": \"5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h\", \"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0\"}, {\"url\": \"https://git.kernel.org/stable/c/47c78d3fc26e38ab805613a0f592dc8a820c7c64\"}, {\"url\": \"https://git.kernel.org/stable/c/5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Skip restore TC rules for vport rep without loaded flag\\n\\nDuring driver unload, unregister_netdev is called after unloading\\nvport rep. So, the mlx5e_rep_priv is already freed while trying to get\\nrpriv-\u003enetdev, or walk rpriv-\u003etc_ht, which results in use-after-free.\\nSo add the checking to make sure access the data of vport rep which is\\nstill loaded.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.70\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.9\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:46:35.806Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-57801\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:46:35.806Z\", \"dateReserved\": \"2025-01-15T13:08:59.741Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-15T13:10:24.619Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.