Linux kernel mlxsw (Spectrum switch ASIC ACL TCAM): On Spectrum-2 and newer, firmware reports more than 16 ACLs per

CVE-2024-26586Firmware, BMC & network fabricmlxsw spectrum_acl_tcam fix stack corruptioncurated

Impact

On Spectrum-2 and newer, firmware reports more than 16 ACLs per group but the driver's register layout was never widened, so putting more than 16 ACLs in a group corrupts the kernel stack and panics the switch. Triggered by adding tc filters with decreasing priority in alternating order - a shape that ordinary policy automation produces. Relevant to anyone running Linux-based switch control on Spectrum silicon.

Who can reach it

Local on the switch with network-configuration privilege - an operator or automation system installing tc filters. Not remotely reachable.

What to do

Upgrade the switch's kernel to 6.8 or a stable backport (5.10.209, 5.15.148, 6.1.79, 6.6.14, 6.7.2). On a Cumulus/NVOS switch that means an OS image upgrade and a switch reload - a fabric rolling window. Interim: constrain your ACL automation so a single group never exceeds 16 ACLs.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-26586 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-26586.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.