CVE-2024-36281: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36281 affects the Linux kernel's Mellanox MLX5 network driver implementation. The vulnerability was discovered in the IPsec status rules handling where rx_create no longer allocates a modify_hdr instance that needs to be cleaned up (Kernel Commit).

The vulnerability stems from an incorrect cleanup of IPsec status rules in the MLX5 network driver. The issue occurs when mlx5_modify_header_dealloc is called on an unallocated modify_hdr instance, leading to a NULL pointer dereference. Additionally, a memory leak exists due to improper handling of two rules populated related to status (Kernel Commit).

When exploited, this vulnerability can cause a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service condition (SUSE Advisory).

The vulnerability requires local access to the system and can be triggered through the IPsec networking stack. The issue has been confirmed to cause system crashes in testing environments (Kernel Commit).

The vulnerability has been patched in the Linux kernel by replacing the incorrect cleanup calls with mlx5_ipsec_rx_status_destroy to properly handle the status rules deletion. Users should update their systems with the latest kernel version that includes this fix (Ubuntu Notice).