CVE-2024-35835: 
Linux Kernel vulnerability analysis and mitigation

A double-free vulnerability was discovered in the Linux kernel's net/mlx5e driver, specifically in the arfs_create_groups function. The vulnerability was identified on May 17, 2024, affecting the Linux kernel's MLX5 Ethernet driver. When memory allocation by kvzalloc fails, arfs_create_groups will free ft->g and return an error, however, arfs_create_table (the only caller of arfs_create_groups) will hold this error and call mlx5e_destroy_flow_table, resulting in ft->g being freed again (Kernel Git).

The vulnerability occurs in the memory management of the MLX5 Ethernet driver's aRFS (Accelerated Receive Flow Steering) implementation. The issue stems from improper error handling in the arfs_create_groups function, where a double-free condition can occur when memory allocation fails. The vulnerability has been assigned a CVSS 3.1 Base Score of 5.3 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability could potentially lead to memory corruption in the Linux kernel, which might result in system instability or potential security implications. The CVSS score indicates that while the vulnerability can be exploited remotely with low complexity, it primarily affects confidentiality with no direct impact on integrity or availability (CISA-ADP).

The vulnerability requires no privileges or user interaction to exploit, as indicated by the CVSS vector (PR:N/UI:N). However, there are no known reports of this vulnerability being actively exploited in the wild.

The vulnerability has been fixed in various Linux distributions through security updates. Ubuntu has released fixes for multiple versions including 23.10 (6.5.0-41.41), 22.04 LTS (5.15.0-106.116), and 20.04 LTS (5.4.0-181.201). Red Hat has also included fixes in their security updates. Users are advised to update their systems to the patched versions (Ubuntu Security).