CVE-2024-26586: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26586 is a stack corruption vulnerability in the Linux kernel's Mellanox Technologies Spectrum Ethernet driver. The issue was discovered in February 2024 and affects the mlxsw spectrum_acl_tcam component when handling ACL groups in Spectrum-2 and newer ASICs (NVD, Kernel Patch).

The vulnerability occurs when tc filters are added to a net device, where the local port gets bound to an ACL group. While the firmware reports that the maximum number of ACLs in a group can be more than 16, the layout of the register that configures ACL groups (PAGT) was not updated accordingly. This mismatch can lead to stack corruption when more than 16 ACLs in a group are required. The vulnerability has a CVSS v3.1 base score of 6.7 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability can result in kernel stack corruption, leading to system crashes and potential privilege escalation. The issue manifests as a kernel panic with the error message 'stack-protector: Kernel stack is corrupted' in the mlxsw_sp_acl_tcam_group_update function (Kernel Patch).

The issue has been fixed by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register. The fix has been incorporated into various Linux kernel versions, including RHEL 8.2, 9.0, and 9.2 (Red Hat Advisory, Kernel Patch).