⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2024-35960NULL Pointer Dereference in Linux

Severity
9.1CRITICALNVD
OSV7.1OSV7.0OSV6.8OSV5.5
EPSS
1.7%
top 17.42%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedMay 20
Latest updateApr 9

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, create_flow_handle tries hard to find and reference already existing identical rules instead of creating new ones. These two behaviors can result in a situation where create_flow_handle 1) creates a new rule and references it, then 2) in a

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages5 packages

NVDlinux/linux_kernel4.104.19.313+7
Debianlinux/linux_kernel< 5.10.216-1+3
Ubuntulinux/linux_kernel< 5.4.0-189.209+3
CVEListV5linux/linux74491de937125d0c98c9b9c9208b4105717a3caade0139719cdda82806a47580ca0df06fc85e0bd2+8
debiandebian/linux< linux 6.1.90-1 (bookworm)

Also affects: Debian Linux 10.0

Patches

🔴Vulnerability Details

21
OSV
linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips vulnerabilities2025-04-09
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities2025-04-09
OSV
linux-xilinx-zynqmp vulnerabilities2024-09-18
OSV
linux-gcp-5.15 vulnerabilities2024-07-30
OSV
linux-raspi vulnerabilities2024-07-26

📋Vendor Advisories

21
Ubuntu
Linux kernel vulnerabilities2025-04-09
Ubuntu
Linux kernel (FIPS) vulnerabilities2025-04-09
Ubuntu
Linux kernel vulnerabilities2024-09-18
Ubuntu
Linux kernel vulnerabilities2024-07-30
Ubuntu
Linux kernel vulnerabilities2024-07-26

💬Community

1
Bugzilla
CVE-2024-35960 kernel: net/mlx5: Properly link new fs rules into the tree2024-05-20