{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-26856",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-26856"
  ],
  "published": "2024-04-17T10:17:34Z",
  "summary": "net: sparx5: Fix use after free inside sparx5_del_mact_entry",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: Fix use after free inside sparx5_del_mact_entry\n\nBased on the static analyzis of the code it looks like when an entry\nfrom the MAC table was removed, the entry was still used after being\nfreed. More precise the vid of the mac_entry was used after calling\ndevm_kfree on the mac_entry.\nThe fix consists in first using the vid of the mac_entry to delete the\nentry from the HW and after that to free it.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.82",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26856"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e46274df1100fb0c06704195bfff5bfbd418bf64"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0de693d68b0a18d5e256556c7c62d92cca35ad52"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e83bebb718fd1f42549358730e1206164e0861d6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/71809805b95052ff551922f11660008fb3666025"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/89d72d4125e94aa3c2140fedd97ce07ba9e37674"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 8.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:A - The vulnerability is driven by Ethernet frames on the L2 segment \u2014 an unauthenticated attacker connected to a Sparx5 switch port populates the MAC table with chosen source MACs, and a MAC roam or FDB age-out makes the bridge emit SWITCHDEV_FDB_DEL_TO_DEVICE into sparx5_del_mact_entry(). No routing is involved, so this is same-broadcast-domain (Adjacent) rather than Network.\nAC:L - The free-then-use is unconditional straight-line code, not a race \u2014 every matching entry deletion frees mact_entry and then reads mact_entry->vid. The attacker controls both the MAC/VID that populates the table and the trigger (moving the same source MAC between ports forces br_fdb_update() to emit the delete notification synchronously), so it is reproducible on demand.\nPR:N - The frame-driven path requires no credentials or account on the switch whatsoever \u2014 MAC learning, roaming, and FDB aging are automatic. The privileged `bridge fdb del` route is only an alternative, strictly weaker trigger.\nUI:N - No victim action is needed; bridge MAC learning, roaming and aging happen automatically in response to attacker-sent frames on an already-configured bridged switch port.\nS:U - The freed object and the corrupted state are both kernel-resident within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - Freed slab memory is read back and acted upon, and the object lives in a general kmalloc cache that concurrent GFP_ATOMIC softirq allocations (including the driver's own attacker-driven switchdev work and skb allocations) can immediately reoccupy, letting an attacker influence and infer freed heap contents. Per use-after-free scoring, UAF primitives generalize to kernel memory disclosure.\nI:H - The stale value read from freed memory is written directly into the hardware MAC-table unlearn command, so the wrong VID is unlearned \u2014 the attacker's revoked MAC stays programmed and forwarded in hardware while an unrelated victim's entry can be purged, corrupting switch forwarding and isolation state. As a use-after-free it also carries the general potential for heap-grooming-based write primitives.\nA:H - Dereferencing freed slab memory can oops outright \u2014 the kfree() immediately preceding the read can discard the last-in-use slab page back to the page allocator \u2014 and KASAN/hardened kernels report or panic on it. The attacker can retrigger it continuously by flooding frames with rotating source MACs, and corrupted MAC-table state causes persistent forwarding breakage."
    }
  }
}