CVE-2024-36888 is a vulnerability identified in the Linux kernel's workqueue subsystem, specifically related to the selection of the wake_cpu in the kick_pool() function. The issue arises when the kernel attempts to bring up secondary CPUs in a system configuration where cpu_possible_mask includes CPUs 0-63 but cpu_online_mask only includes CPUs 0-7. Under these conditions, a kernel oops (crash) occurs due to a null pointer dereference in the virtual kernel address space. The root cause is that the function arch_vcpu_is_preempted() is called for an offline CPU, which is invalid and leads to the crash. The vulnerability stems from the workqueue code selecting a CPU that is not currently online to wake up, which results in unpredictable behavior and system instability. The proposed fix involves using cpumask_any_and_distribute() to ensure that the CPU selected for the wake call is masked by the online CPUs, and skipping the assignment if no suitable CPU is found. However, the patch does not fully resolve the issue because CPUs can still go offline between the selection and the wake call, suggesting that additional checks (e.g., cpu_online() tests) in the scheduler or architecture-specific code (such as s390) are necessary for a complete fix. This vulnerability is classified under CWE-476 (NULL Pointer Dereference) and has a CVSS 3.1 base score of 6.2, indicating a medium severity level. The attack vector is local (AV:L), requiring no privileges (PR:N) or user interaction (UI:N), and impacts availability (A:H) without affecting confidentiality or integrity. No known exploits are currently reported in the wild, and no patches are linked yet, indicating that mitigation relies on applying forthcoming kernel updates once available.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions, especially those with multi-CPU configurations where some CPUs may be offline or dynamically managed. The kernel crash caused by this vulnerability can lead to denial of service (DoS) conditions, impacting availability of critical services and infrastructure. This is particularly concerning for data centers, cloud providers, telecom operators, and industrial control systems that rely on Linux for stability and uptime. Systems that perform CPU hotplugging or have complex CPU affinity configurations are at higher risk. While the vulnerability does not compromise confidentiality or integrity directly, the resulting system crashes can disrupt business operations, cause service outages, and potentially lead to cascading failures in dependent systems. European organizations with high availability requirements, such as financial institutions, healthcare providers, and public sector entities, may experience operational disruptions if this vulnerability is exploited or triggered inadvertently. The lack of known exploits reduces immediate risk, but the medium severity and potential for system instability necessitate prompt attention.

To mitigate CVE-2024-36888, European organizations should: 1) Monitor Linux kernel updates closely and apply patches as soon as they are released by trusted sources or distributions, ensuring that the fix for the workqueue wake_cpu selection is included. 2) Audit and review CPU hotplug and affinity configurations to minimize scenarios where CPUs are offline but still targeted by kernel workqueue operations. 3) Implement kernel crash monitoring and alerting to detect early signs of this vulnerability manifesting, enabling rapid response and system recovery. 4) For critical systems, consider temporarily restricting CPU hotplug operations or limiting dynamic CPU management until a full fix is applied. 5) Engage with Linux distribution vendors and maintainers to verify that the kernel versions deployed in production environments incorporate the necessary fixes. 6) Conduct thorough testing in staging environments with multi-CPU setups to identify any instability related to this issue before deploying updates in production. 7) Document and prepare incident response plans for potential DoS scenarios caused by kernel crashes, ensuring minimal operational impact.