CVE-2024-35795 is a vulnerability identified in the Linux kernel, specifically within the AMDGPU driver component that handles debugfs interactions related to MQD (Micro-Queue Descriptor) reads. The flaw manifests as a deadlock condition triggered when reading from the amdgpu debugfs files. The root cause is a circular locking dependency involving multiple kernel locks: the reservation_ww_class_mutex, reservation_ww_class_acquire, and the mm->mmap_lock. This deadlock occurs when a process attempts to acquire these locks in an unsafe order, leading to a situation where the kernel tasks wait indefinitely for locks held by each other, causing a system hang or hard reset. The vulnerability was discovered during an errant disk backup operation that accessed debugfs, which is a virtual filesystem used for debugging purposes. The kernel logs show warnings about circular locking dependencies and detailed stack traces pinpointing the exact locking functions involved. This issue affects Linux kernel versions containing the vulnerable AMDGPU driver code prior to the patch. Although no CVSS score has been assigned yet, the vulnerability is significant because it can cause system instability, crashes, or denial of service (DoS) conditions on affected systems. The vulnerability does not appear to require user interaction beyond triggering a read operation on debugfs and does not require elevated privileges beyond those needed to access debugfs files. No known exploits are currently reported in the wild, but the potential for disruption exists, especially on systems using AMD GPUs with the affected Linux kernel versions.

For European organizations, the impact of CVE-2024-35795 primarily involves system availability and stability. Servers, workstations, or embedded devices running vulnerable Linux kernels with AMDGPU drivers could experience unexpected deadlocks leading to system hangs or hard resets. This can disrupt business operations, especially in environments relying on Linux for critical infrastructure, cloud services, or high-performance computing where AMD GPUs are deployed. The denial of service caused by this deadlock could affect data centers, research institutions, and enterprises using AMD GPU-accelerated workloads. Additionally, the instability may complicate maintenance and troubleshooting, increasing operational costs. Although the vulnerability does not directly expose confidentiality or integrity risks, the availability impact can indirectly affect service delivery and compliance with uptime requirements under European regulations. Organizations with Linux-based systems in sectors such as finance, healthcare, manufacturing, and public services should be particularly vigilant, as unexpected system crashes could lead to operational downtime and potential data loss if not properly managed.

To mitigate CVE-2024-35795, European organizations should: 1) Apply the latest Linux kernel patches as soon as they become available from trusted sources or Linux distribution vendors, ensuring the AMDGPU driver deadlock fix is included. 2) Restrict access to debugfs, especially the amdgpu debugfs files, to trusted administrators only, as the vulnerability is triggered via debugfs reads. This can be done by mounting debugfs with appropriate permissions or disabling debugfs entirely on production systems where it is not needed. 3) Monitor system logs for warnings related to circular locking dependencies or deadlocks involving amdgpu to detect potential exploitation attempts or system instability early. 4) Implement robust system monitoring and automated recovery mechanisms to detect and remediate system hangs or crashes quickly, minimizing downtime. 5) For critical environments, consider isolating or limiting the use of AMD GPUs until patches are applied, or use alternative GPU drivers if feasible. 6) Engage with Linux distribution security advisories and maintain an up-to-date inventory of affected kernel versions to prioritize patching efforts effectively.