CVE-2024-35991 addresses a synchronization vulnerability in the Linux kernel's dmaengine idxd driver, specifically related to the locking mechanism used for the event log workqueue. The vulnerability arises because the existing implementation uses a spinlock to protect the event log workqueue, but the function drain_workqueue() cannot be safely called in a spinlocked context due to the possibility of task rescheduling. In scenarios where multiple tasks are involved, calling queue_work() while drain_workqueue() is active leads to a kernel Call Trace, indicating a critical error state caused by pushing work onto a draining workqueue under spinlock protection. This results in kernel instability and potential crashes. The root cause is that spinlocks do not allow for task rescheduling, which is necessary when queue_work() is called, leading to unsafe conditions. The fix converts the spinlock to a mutex, which permits safe locking with task rescheduling allowed. This change ensures that drain_workqueue() can be called safely within a mutex-locked context, preventing the Call Trace and improving kernel robustness. The vulnerability affects specific Linux kernel versions identified by commit hashes, and no known exploits are reported in the wild as of the publication date. The issue is technical and specific to kernel developers and system administrators managing Linux systems with the dmaengine idxd driver enabled.

For European organizations, the impact of this vulnerability primarily concerns systems running affected Linux kernel versions with the dmaengine idxd driver active. This includes servers and infrastructure handling high-performance data movement tasks, such as data centers, cloud providers, and enterprises using Linux for critical workloads. The vulnerability can cause kernel crashes and instability, leading to denial of service (DoS) conditions. While it does not directly lead to privilege escalation or data leakage, the resulting system instability can disrupt business operations, cause downtime, and potentially impact service availability. Organizations relying on Linux-based infrastructure for critical applications may experience operational interruptions. Additionally, kernel crashes can complicate forensic analysis and incident response. Given the absence of known exploits, the immediate risk is moderate, but unpatched systems remain vulnerable to accidental or targeted triggering of the bug, especially in multi-tasking environments. The vulnerability's impact on confidentiality and integrity is low, but availability impact is medium to high depending on system criticality.

European organizations should prioritize updating their Linux kernels to versions that include the fix converting the spinlock to a mutex in the dmaengine idxd driver. Kernel updates should be tested in staging environments to ensure compatibility. For systems where immediate patching is not feasible, administrators should monitor kernel logs for Call Trace patterns related to queue_work() and drain_workqueue() in the idxd driver context, which may indicate attempts to trigger the issue. Limiting workloads that heavily utilize the dmaengine idxd driver or isolating affected systems can reduce exposure. Organizations should also review their kernel configuration to disable the idxd driver if it is not required, minimizing the attack surface. Implementing robust system monitoring and alerting for kernel errors will help detect potential exploitation attempts or accidental triggers. Coordination with Linux distribution vendors for timely patch deployment is essential. Finally, maintaining comprehensive backups and disaster recovery plans will mitigate operational impact in case of system crashes.