CVE-2024-35957 is a medium-severity vulnerability in the Linux kernel related to the Intel IOMMU (Input-Output Memory Management Unit) VT-d driver. The vulnerability arises from an incorrect assumption in the kernel code that each device probed by the IOMMU driver has a unique source ID. Specifically, a commit (1a75cc710b95) introduced a red-black tree (rbtree) data structure to track devices indexed by their source IDs. However, the VT-d specification does not guarantee uniqueness of source IDs across devices, leading to potential conflicts and erroneous behavior. The kernel code attempts to track only devices with PCI ATS (Address Translation Services) capabilities in this rbtree to avoid warnings and failures during the IOMMU probe path. Without this fix, some platforms may experience kernel warnings (WARN_ON) and probe failures, which can cause kernel panics (kernel splats) and disrupt system stability. The vulnerability manifests as a WARN_ON triggered during the probing of devices by the Intel IOMMU driver, potentially leading to system crashes or denial of service. The issue affects Linux kernel versions containing the specified commits and is resolved by restricting the rbtree tracking to PCI ATS-capable devices only. The CVSS 3.1 base score is 5.9 (medium), with attack vector local, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability, albeit limited. There are no known exploits in the wild at this time. The vulnerability primarily affects systems using Intel VT-d IOMMU technology, which is common in servers and workstations requiring device isolation and DMA remapping for security and virtualization purposes.

For European organizations, the impact of CVE-2024-35957 depends largely on their deployment of Linux systems with Intel VT-d enabled. Organizations running virtualized environments, cloud infrastructure, or high-security servers that rely on IOMMU for device isolation and protection may face system instability or denial of service due to kernel panics triggered by this vulnerability. This could lead to service outages, data integrity issues, and potential exposure of sensitive information if the system crashes during critical operations. While the vulnerability does not appear to allow remote code execution or privilege escalation directly, the resulting system instability can disrupt business operations and impact availability. Industries such as finance, telecommunications, government, and critical infrastructure in Europe, which often deploy Linux-based servers with advanced hardware features, may be particularly affected. The vulnerability's local attack vector means that an attacker or malicious insider with local access could trigger the issue, emphasizing the need for strict access controls. The absence of known exploits reduces immediate risk but does not eliminate the potential for future exploitation, especially in targeted attacks against high-value assets.

European organizations should apply the Linux kernel patches that address CVE-2024-35957 as soon as they become available from their Linux distribution vendors. Specifically, ensure that kernel versions include the fix that restricts the rbtree tracking to PCI ATS-capable devices only. For environments where immediate patching is not feasible, consider disabling Intel VT-d IOMMU functionality temporarily if it does not critically impact operations, to avoid triggering the vulnerability. Additionally, implement strict local access controls and monitoring to prevent unauthorized users from exploiting local access to provoke kernel warnings or crashes. Regularly audit and update kernel versions and monitor vendor advisories for any related updates or exploit reports. In virtualized environments, ensure hypervisor and guest OS configurations are hardened and that device assignment policies do not expose vulnerable IOMMU paths. Employ kernel crash dump analysis and system monitoring to detect early signs of exploitation or instability related to this vulnerability. Finally, maintain robust backup and recovery procedures to mitigate the impact of potential denial-of-service conditions.