CVE-2024-35995 is a vulnerability identified in the Linux kernel related to the Advanced Configuration and Power Interface (ACPI) CPPC (Collaborative Processor Performance Control) subsystem. The issue arises from improper handling of system memory accesses where the kernel code incorrectly relies on the bit_width parameter instead of the access_width parameter to determine the size of memory accesses. According to the ACPI 6.3+ specification, bit_width can be any 8-bit value and is not guaranteed to align on a clean 8-bit boundary, which can lead to incorrect memory access calculations. This flaw was discovered on the Cobalt 100 platform and manifests as asynchronous system errors (SError Interrupts) causing kernel panics, specifically observed on ARM64 architectures. The vulnerability can cause system instability and crashes during CPU frequency scaling operations managed by the cppc_cpufreq driver, as the kernel attempts to read or write performance capabilities incorrectly. The root cause is that the kernel code uses bit_width for memory access size calculations instead of access_width, which should be used to correctly shift and mask bits for reading and writing. The fix involves switching to use access_width when available and falling back to bit_width only if access_width is not set, along with additional checks for system memory to avoid misinterpretation of access_width in certain contexts. This vulnerability does not currently have known exploits in the wild and affects Linux kernel versions prior to the patch. It is a low-level kernel bug that can cause denial of service through system crashes but does not directly indicate privilege escalation or arbitrary code execution.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions on ARM64 platforms, especially those using ACPI CPPC for CPU frequency scaling. The impact is mainly on system availability due to kernel panics triggered by asynchronous SError interrupts. This can lead to unexpected system reboots or downtime, affecting critical infrastructure, cloud services, and enterprise servers that rely on stable Linux kernel operation. Organizations using ARM64-based servers or embedded systems with Linux kernels prior to the fix may experience service interruptions. While the vulnerability does not appear to allow direct compromise of confidentiality or integrity, the denial of service impact can disrupt business operations, particularly in environments requiring high availability such as financial services, telecommunications, and industrial control systems. The lack of known exploits reduces immediate risk, but unpatched systems remain vulnerable to accidental or targeted triggering of the bug, potentially causing operational disruptions.

European organizations should prioritize updating their Linux kernels to the latest stable versions that include the patch for CVE-2024-35995. Specifically, kernel versions released after May 2024 should be deployed. For environments where immediate patching is not feasible, organizations should monitor system logs for SError interrupts and kernel panics related to cppc_cpufreq or ACPI CPPC operations as early warning signs. Disabling or limiting the use of CPPC CPU frequency scaling on affected ARM64 systems can serve as a temporary workaround to prevent triggering the vulnerability. Additionally, organizations should ensure robust system monitoring and automated reboot mechanisms to minimize downtime impact. Testing kernel updates in staging environments before production rollout is recommended to avoid regressions. Finally, maintaining an inventory of ARM64 Linux systems and their kernel versions will help prioritize patch management efforts.