CVE-2024-26847 is a vulnerability identified in the Linux kernel specifically affecting the PowerPC architecture's RTAS (Run-Time Abstraction Services) implementation. The issue arises from a mismatch in the function name used to reset TCE (Translation Control Entry) tables in device firmware interaction. According to the PAPR (Power Architecture Platform Reference) specification, the function should be named "ibm,reset-pe-dma-windows" (plural), but in practice, the firmware uses the singular form "ibm,reset-pe-dma-window" in the device tree. The Linux kernel's RTAS function table incorrectly uses the plural form, causing reverse lookups from token to function name to fail. This failure triggers warning messages and kernel oopses, particularly when lockdep (lock dependency validator) or RTAS tracepoints are enabled. The kernel oopses occur because the code dereferences the result of the failed lookup, leading to potential kernel crashes or instability. The vulnerability affects Linux kernel versions prior to the fix that corrects the function name spelling to match firmware behavior. The impact is primarily on systems running on IBM POWER10 hardware or similar PowerPC platforms using RTAS for device management. The CVSS 3.1 score is 5.1 (medium severity), reflecting a local attack vector with high attack complexity, no privileges required, no user interaction, and an impact limited to availability (kernel crashes). There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

For European organizations, the impact of CVE-2024-26847 is mainly related to system stability and availability on affected PowerPC-based Linux systems, particularly those using IBM POWER10 hardware or similar platforms. Organizations relying on such hardware for critical infrastructure, data centers, or specialized computing environments may experience unexpected kernel crashes or system instability if the vulnerable kernel version is deployed. This can lead to service disruptions, potential downtime, and increased operational costs due to troubleshooting and recovery efforts. Since the vulnerability does not affect confidentiality or integrity, the risk of data breach or unauthorized access is minimal. However, availability issues can still have significant operational consequences, especially in environments requiring high reliability. The vulnerability requires local access and has high attack complexity, reducing the likelihood of exploitation by remote attackers. Nevertheless, insider threats or compromised local users could trigger the issue. The lack of known exploits in the wild further reduces immediate risk but does not eliminate the need for timely patching.

To mitigate CVE-2024-26847, European organizations should: 1) Identify and inventory Linux systems running on PowerPC architecture, especially IBM POWER10 hardware, to assess exposure. 2) Apply the official Linux kernel patches that correct the RTAS function name spelling to match firmware behavior. This fix prevents the failed token lookups and associated kernel oopses. 3) If immediate patching is not possible, consider disabling lockdep and RTAS tracepoints temporarily to reduce the risk of kernel crashes, though this is not a long-term solution. 4) Monitor system logs for warning messages related to RTAS token lookup failures or kernel oopses to detect potential triggering of the vulnerability. 5) Implement strict access controls to limit local user access on affected systems, minimizing the risk of exploitation. 6) Coordinate with hardware vendors and Linux distribution maintainers to ensure timely updates and support. 7) Test patches in a controlled environment before deployment to avoid unintended disruptions. These steps go beyond generic advice by focusing on architecture-specific identification, targeted patching, and operational monitoring tailored to the nature of this vulnerability.