cbcvebase.
CVE-2024-57801
published 2025-01-15

CVE-2024-57801: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Skip restore TC rules for vport rep without loaded flag During driver unload…

PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.22%
12.5th percentile
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Skip restore TC rules for vport rep without loaded flag During driver unload, unregister_netdev is called after unloading vport rep. So, the mlx5e_rep_priv is already freed while trying to get rpriv->netdev, or walk rpriv->tc_ht, which results in use-after-free. So add the checking to make sure access the data of vport rep which is still loaded.

Affected

11 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.12.9-1 (forky)linux 6.12.9-1 (forky)
linuxlinux
linuxlinux>= d1569537a837d66620aa7ffc2bddf918e902f227 < 3e45dd1622a2c1a83c11bf42fdd8c1810123d6c03e45dd1622a2c1a83c11bf42fdd8c1810123d6c0
linuxlinux>= d1569537a837d66620aa7ffc2bddf918e902f227 < 47c78d3fc26e38ab805613a0f592dc8a820c7c6447c78d3fc26e38ab805613a0f592dc8a820c7c64
linuxlinux>= d1569537a837d66620aa7ffc2bddf918e902f227 < 5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.12.9-16.12.9-1
linuxlinux_kernel>= 0 < 6.12.9-16.12.9-1
linuxlinux_kernel>= 0 < 6.8.0-60.636.8.0-60.63
linuxlinux_kernel>= 6.6 < 6.6.706.6.70
linuxlinux_kernel>= 6.7 < 6.12.96.12.9

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.