CVE-2024-36884 is a vulnerability identified in the Linux kernel specifically affecting the ARM System Memory Management Unit (SMMU) driver implementation used in NVIDIA hardware, such as the NVIDIA Jetson Orin NX platform. The root cause is a type mismatch in the function pointer indirection within the nvidia_smmu_context_fault() function. This function is registered as an interrupt request (IRQ) handler but incorrectly uses a 'void *' pointer type instead of the correct 'struct arm_smmu_domain *'. Because the iommu_domain structure is embedded at a non-zero offset, this type mismatch causes the function to miscalculate memory offsets, leading to a NULL pointer dereference. The dereference occurs at a low virtual address (0x120), triggering a kernel oops and a level 0 translation fault in the memory management unit. This results in an unrecoverable kernel crash (panic) on affected systems. The vulnerability is triggered during IRQ handling related to the ARM SMMU domain freeing and device removal processes, which can be invoked during device hotplug or driver unload operations. The detailed kernel stack trace shows the fault arises during calls to free_irq and iommu_domain_free functions, indicating improper cleanup of IRQ resources due to the pointer type error. This bug was introduced due to a subtle change in the pointer type that was missed because of function pointer indirection, highlighting the complexity of kernel interrupt handling code. The vulnerability affects Linux kernel versions including 6.9.0-0.rc7.58.eln136.aarch64 and is specific to ARM64 architecture with NVIDIA SMMU hardware. No known exploits are reported in the wild as of the publication date. No CVSS score has been assigned yet. The issue is resolved by correcting the pointer type to properly reference the arm_smmu_domain structure, ensuring correct offset calculations and preventing the NULL pointer dereference and consequent kernel panic.

For European organizations, the impact of CVE-2024-36884 depends largely on the deployment of affected hardware and Linux kernel versions. Organizations using NVIDIA Jetson Orin NX or similar ARM64-based embedded systems running vulnerable Linux kernels are at risk of system instability and denial of service due to kernel crashes. This can disrupt critical applications relying on these embedded platforms, such as industrial automation, IoT gateways, edge computing devices, and AI inference systems. The vulnerability could be triggered during device removal or driver unload operations, potentially causing unexpected downtime or requiring system reboots. Although no remote code execution or privilege escalation is indicated, the denial of service impact on availability can be significant for operational technology environments or edge deployments in sectors like manufacturing, automotive, and telecommunications. Given the increasing adoption of ARM64-based NVIDIA platforms in European industrial and research sectors, this vulnerability could affect organizations relying on these platforms for critical workloads. The lack of known exploits reduces immediate risk, but the vulnerability should be addressed promptly to maintain system reliability and security posture.

To mitigate CVE-2024-36884, European organizations should: 1) Apply the latest Linux kernel patches from trusted sources that correct the pointer type mismatch in the nvidia_smmu_context_fault() function. 2) For embedded devices running custom or vendor-provided kernels, coordinate with hardware vendors (e.g., NVIDIA) to obtain updated firmware and kernel versions that include the fix. 3) Implement rigorous testing of kernel updates in staging environments to ensure stability before production deployment, especially for embedded and edge systems. 4) Monitor system logs for kernel oops or crashes related to ARM SMMU IRQ handling to detect potential exploitation or triggering of the vulnerability. 5) Limit device hotplug or driver unload operations on affected systems until patches are applied, as these operations can trigger the fault. 6) Employ kernel crash dump analysis tools to investigate any unexpected reboots or panics to confirm if related to this vulnerability. 7) Maintain an inventory of devices running affected kernel versions and NVIDIA ARM64 hardware to prioritize patching efforts. 8) Engage with security advisories from Linux kernel maintainers and NVIDIA for ongoing updates and best practices.