CVE-2024-35989 is a medium severity vulnerability identified in the Linux kernel's dmaengine idxd driver. The flaw occurs during the removal (rmmod) of the idxd driver on single-CPU platforms. Specifically, when the idxd driver is unloaded, it invokes a registered offline callback as part of its cleanup process. This callback attempts to migrate the performance monitoring (perf) context to another CPU. However, on systems with only one CPU online, there is no valid target CPU available for this migration. This leads to a kernel oops, a type of kernel crash caused by an invalid memory access. The oops is triggered by a page fault during a kernel-mode write operation, as the perf context migration tries to lock a mutex on a non-existent CPU target, resulting in a BUG error and system instability. The vulnerability is rooted in improper handling of CPU offline callbacks and perf context migration logic on single-CPU systems. The fix implemented prevents migration attempts to invalid CPU targets, thereby avoiding the kernel oops. The CVSS v3.1 score is 5.5 (medium severity) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local attack vector, low complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability due to kernel crash. No known exploits are reported in the wild as of publication. This vulnerability affects Linux kernel versions containing the vulnerable idxd driver code prior to the fix. The issue is particularly relevant for single-CPU systems using the idxd driver, which is related to Intel Data Streaming Accelerator (DSA) hardware for DMA operations.

For European organizations, the impact of CVE-2024-35989 depends largely on the deployment of Linux systems running on single-CPU platforms with the idxd driver enabled. The vulnerability causes a kernel oops leading to system crashes and potential denial of service (DoS). This can disrupt critical services, especially in embedded systems, industrial control systems, or specialized appliances that might use single-CPU Linux kernels with idxd support. While the vulnerability does not allow privilege escalation or data compromise, the availability impact can be significant for systems requiring high uptime or real-time processing. European enterprises relying on Linux-based infrastructure for networking, telecommunications, or edge computing might be affected if their hardware platforms include Intel DSA components and run single-CPU configurations. The disruption could lead to operational downtime, impacting service delivery and compliance with availability SLAs. However, multi-CPU systems are not affected by this issue, limiting the scope somewhat. Since no known exploits exist yet, the immediate risk is moderate, but organizations should prioritize patching to prevent potential future exploitation or accidental crashes during maintenance operations involving driver removal.

1. Apply the official Linux kernel patch that fixes the idxd driver to prevent perf context migration to invalid CPU targets. Ensure all Linux systems, especially those running on single-CPU platforms with idxd enabled, are updated promptly. 2. Audit systems to identify single-CPU Linux hosts with the idxd driver loaded. Disable or unload the idxd driver on systems where it is not required to reduce attack surface. 3. For critical systems where kernel updates are challenging, consider implementing monitoring to detect kernel oops or crashes related to idxd driver removal and automate recovery procedures. 4. Avoid removing the idxd driver module on single-CPU systems during runtime unless necessary, or ensure the system is rebooted after removal to prevent instability. 5. Coordinate with hardware vendors to confirm Intel DSA hardware usage and driver compatibility with patched kernel versions. 6. Incorporate this vulnerability into vulnerability management and patching workflows with priority for affected single-CPU Linux systems. 7. Test kernel updates in staging environments that replicate single-CPU configurations to validate stability before production deployment.