Medium 5.5Published May 20, 2024

CVE-2024-36006mlxsw: spectrum_acl_tcam: Fix incorrect list API usage

Updated under an hour ago (Oct 26, 2026, 8:23 PM ET)

Does this affect you?

It affects Linux and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_first_entry() on the respective lists without checking that the lists are not empty. This is incorrect usage of the API, which leads to the following warning [1]. Fix by returning if the lists are empty as there is nothing to migrate in this case. [1] WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> Modules linked in: CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 [...] Call Trace: <TASK> mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf builds before 0b2c13b670b168e324e1cf109e67056a20fd610a; from 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf before 09846c2309b150b8ce4e0ce96f058197598fc530; from 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf before 64435b64e43d8ee60faa46c0cd04e323e8b2a7b0; from 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf before 4526a56e02da3725db979358964df9cd9c567154; from 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf before ab4ecfb627338e440ae11def004c524a00d93e40; from 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf before af8b593c3dd9df82cb199be65863af004b09fd97; from 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf before b377add0f0117409c418ddd6504bd682ebe0bf79	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.1	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	all versions not affected	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.1	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.1 before 5.4.275; from 5.5 before 5.10.216; from 5.11 before 5.15.158; from 5.16 before 6.1.90; from 6.2 before 6.6.30; from 6.7 before 6.8.9; 6.9; 6.9; and 3 more ranges	NVD
debian debian_linux debian:debian_linux	10.0	NVD

References

References

https://git.kernel.org/stable/c/0b2c13b670b168e324e1cf109e67056a20fd610a	patch
https://git.kernel.org/stable/c/09846c2309b150b8ce4e0ce96f058197598fc530	patch
https://git.kernel.org/stable/c/64435b64e43d8ee60faa46c0cd04e323e8b2a7b0	patch
https://git.kernel.org/stable/c/4526a56e02da3725db979358964df9cd9c567154	patch
https://git.kernel.org/stable/c/ab4ecfb627338e440ae11def004c524a00d93e40	patch
https://git.kernel.org/stable/c/af8b593c3dd9df82cb199be65863af004b09fd97	patch
https://git.kernel.org/stable/c/b377add0f0117409c418ddd6504bd682ebe0bf79	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html	mailing-list, third-party-advisory
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
https://cert-portal.siemens.com/productcert/html/ssa-613116.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.