CVE-2024-26645 is a concurrency-related vulnerability in the Linux kernel's tracing subsystem, specifically impacting multi-processor AArch64 (ARM64) architectures. The flaw arises from improper memory ordering in the function __tracing_map_insert(), which is responsible for inserting elements into a tracing map used for kernel event tracing and debugging. The vulnerability manifests when two commands are run in parallel on a multi-core ARM64 machine, causing sporadic warnings about duplicate histogram entries and kernel trace errors. The root cause is that the write operations within __tracing_map_insert()—specifically the memcpy of the key and the assignment of the entry value pointer—may be reordered by the CPU. This reordering can cause another CPU to observe an inconsistent state where the entry pointer is set before the key data is fully written, leading to incorrect assumptions about key uniqueness and resulting in duplicate entries or warnings. The issue is triggered by concurrent access patterns involving the tracing debugfs interface and stress testing tools like stress-ng. The kernel logs show warnings and stack traces pointing to tracing_map_sort_entries(), indicating that the sorting and validation of tracing map entries are affected. This vulnerability is not known to be exploited in the wild and does not have an assigned CVSS score yet. It affects Linux kernel versions identified by the commit hash c193707dde77ace92a649cd59a17e105e2fbeaef and likely other versions with similar tracing map implementations on ARM64 platforms. The problem is fundamentally a race condition due to weak memory ordering guarantees on ARM64 CPUs, which can cause kernel tracing data structures to become inconsistent under heavy concurrent load.

For European organizations, the impact of CVE-2024-26645 depends largely on their use of Linux systems running on ARM64 hardware, such as servers, cloud instances, or embedded devices. Organizations leveraging ARM64-based infrastructure—particularly cloud providers or enterprises using ARM-based servers—may experience kernel instability, warnings, or potential crashes when running tracing tools or stress tests concurrently. While the vulnerability does not directly lead to privilege escalation or remote code execution, the resulting kernel warnings and potential trace data corruption can impair system diagnostics and monitoring capabilities. This can hinder incident response and forensic analysis, reducing operational visibility. In critical environments, such as telecommunications, industrial control systems, or cloud service providers in Europe that utilize ARM64 Linux kernels, this could translate into reduced reliability and increased troubleshooting overhead. However, since exploitation requires specific concurrent operations and is not known to cause data corruption or security breaches directly, the immediate risk to confidentiality and integrity is low. Availability could be moderately impacted if kernel warnings escalate to crashes or system instability under heavy tracing workloads.

European organizations should apply the official Linux kernel patches that address this memory ordering issue in the tracing subsystem as soon as they become available. Until patched, it is advisable to limit or avoid running concurrent tracing commands or stress tests that heavily interact with the tracing debugfs interface on ARM64 Linux systems. System administrators should monitor kernel logs for duplicate histogram warnings or tracing_map_sort_entries errors as indicators of this issue. For environments where tracing is critical, consider isolating tracing workloads to single-core or single-threaded contexts to reduce concurrency risks. Additionally, deploying kernel versions with improved memory barrier usage in tracing_map_insert() can prevent CPU reordering issues. Organizations using cloud services should verify that their providers have applied relevant kernel updates on ARM64 instances. Finally, incorporating kernel tracing error detection into monitoring and alerting systems can help identify occurrences of this issue promptly.