What is the CVSS score of CVE-2024-35835?

CVE-2024-35835 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Linux Kernel are affected by CVE-2024-35835?

The Linux kernel's Mellanox/NVIDIA network driver contains a privilege escalation vulnerability that allows local users to gain administrative access, creating risk of complete system compromise.. A patch is available.

How to fix or mitigate CVE-2024-35835?

Within 24 hours, identify all systems using Mellanox/NVIDIA MLX5-family NICs and determine which are running vulnerable kernel versions based on CVE-2024-35835 advisories. Within 7 days, deploy available kernel patches to all identified systems, prioritizing production environments; for systems where immediate patching is not possible, disable the mlx5e driver if these NICs are not operationally required. Within 30 days, confirm patch deployment across the entire affected fleet, validate system stability post-patch, and document the incident response actions taken.

Linux Kernel CVE-2024-35835

HIGH

Double Free (CWE-415)

2024-05-17 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Debian Debian Linux

7.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Requires both mlx5 NIC hardware presence and engineering a specific kvzalloc failure path, justifying AC:H over NVD's AC:L; all other metrics align with the NVD assessment.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 12:44 vuln.today

v3 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:42 vuln.today

v2 (cvss_changed)

Analysis Updated

Aug 04, 2026 - 12:42 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

MEDIUM HIGH

CVSS changed

Aug 04, 2026 - 11:23 NVD

5.3 (MEDIUM) 7.8 (HIGH)

CVE Published

May 17, 2024 - 14:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix a double-free in arfs_create_groups

When in allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again.

AnalysisAI

Double-free memory corruption in the Linux kernel's mlx5e Ethernet driver exposes systems running Mellanox/NVIDIA MLX5-family NICs to local privilege escalation. The flaw resides in the ARFS (Accelerated Receive Flow Steering) subsystem: when kvzalloc fails inside arfs_create_groups, that function frees ft->g as part of its own cleanup, but its sole caller arfs_create_table subsequently invokes mlx5e_destroy_flow_table on the same error return, freeing ft->g a second time and corrupting the kernel heap. Eight upstream patch commits across multiple stable kernel branches confirm vendor acknowledgment; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

The vulnerable code resides in the net/mlx5e driver, which implements support for NVIDIA/Mellanox ConnectX-series network interface cards. ARFS (Accelerated Receive Flow Steering) is a Linux kernel feature that offloads packet-to-CPU-queue steering decisions to NIC hardware via flow tables; arfs_create_table and arfs_create_groups build those flow table group descriptors at initialization time. CWE-415 (Double Free) arises from an error-path ownership assumption mismatch: arfs_create_groups frees ft->g upon kvzalloc failure before returning an error code, but arfs_create_table - the only caller - unconditionally calls mlx5e_destroy_flow_table on any error return, which also frees ft->g. In the kernel allocator, double-freeing a slab object corrupts the allocator's free-list metadata, a primitive that kernel exploit techniques such as heap spraying can leverage to achieve arbitrary write access and privilege escalation. The CPE data confirms affected targets are cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple version ranges, including the 6.8-rc1 development cycle, plus cpe:2.3:o:debian:debian_linux:10.0.

RemediationAI

Apply the upstream kernel patches confirmed via eight stable-branch commits on git.kernel.org: 2501afe6c4c9, 3c6d5189246f, 42876db001bb, 66cc521a739c, b21db3f1ab79, c57ca114eb00, cf116d9c3c2a, and e3d3ed8c1529 (full URLs in references). Distribution maintainers should be tracked for backported packages - Debian users should apply updates via the standard linux security update channel. Exact fixed kernel version numbers per stable series are not independently confirmed in available data and should be verified against the respective stable branch changelogs at git.kernel.org/stable. As an immediate compensating control for environments that do not require hardware-offloaded flow steering, disable ARFS on the affected interface with ethtool -K <interface> ntuple off; this prevents the vulnerable arfs_create_table code path from being invoked without affecting basic connectivity, but eliminates NIC-level receive-side packet distribution and may increase CPU load for high-throughput workloads.