CVE-2024-26586: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net de

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net de

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn, each ACL points to a different TCAM region where the filters are stored. During forwarding, the ACLs are sequentially evaluated until a match is found. One reason to place filters in different regions is when they are added with decreasing priorities and in an alternating order so that two consecutive filters can never fit in the same region because of their key usage. In Spectrum-2 and newer ASICs the firmware started to report that the maximum number of ACLs in a group is more than 16, but the layout of the register that configures ACL groups (PAGT) was not updated to account for that. It is therefore possible to hit stack corruption [1] in the rare case where more than 16 ACLs in a group are required. Fix by limiting the maximum ACL group size to the minimum between what the firmware reports and the maximum ACLs that fit in the PAGT register. Add a test case to make sure the machine does not crash w

Description from the National Vulnerability Database, published by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

What it means for a small business

Linux is on the computers, phones or browsers your team uses every day. Turn on automatic updates and restart: most of these fixes only take effect after a restart.

How likely is an attack? The Exploit Prediction Scoring System, run by FIRST (the global association of security response teams), puts the odds of this one being exploited in the next 30 days at 0.25%, higher than 15% of CVEs. That’s low, but low isn’t zero, and the odds jump the day someone publishes an exploit. Scored October 29, 2026, updated daily.

Check your own setup

Website check: reads what your site runs from the outside (WordPress version, plugins it can see, old server software) and matches it against this database.
Server check: what your web server says about itself, and whether that version has known flaws.

Sources

Part of the Huttenlocher Technologies vulnerability database, refreshed twice a day from CISA and the NVD. The title, category and plain-language guidance are ours; check the linked record before acting on a detail. This is general guidance, not a review of your systems.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.