CVE-2024-36906 is a vulnerability identified in the Linux kernel specifically affecting ARM64 architectures. The issue arises from improper handling of stale stack poison in the Kernel Address Sanitizer (KASAN) instrumentation during CPU idle state transitions. KASAN is a memory error detector that poisons stack memory regions upon function entry and clears them upon exit to detect out-of-bounds (OOB) and use-after-free bugs. However, in the cpuidle subsystem, CPUs exit the kernel several levels deep in C code, and the normal unpoisoning process is bypassed. This leads to stale poison remaining on the stack shadow memory. When the CPU returns to the kernel via a cold path, the context restored from __cpu_suspend_enter does not clear this stale poison. Consequently, subsequent kernel functions instrumented by KASAN may incorrectly detect memory errors, causing spurious KASAN alerts and potential kernel crashes due to stack-out-of-bounds writes, as demonstrated by the OOB crash logs. The root cause is that the ARM64 kernel did not clear stale stack poison during CPU idle transitions. The fix involves patching the ARM64 kernel assembly code (arch/arm64/kernel/sleep.S) to clear stale poison from the idle thread stack before bringing CPUs online, ensuring that KASAN instrumentation does not trigger false positives or kernel instability. This vulnerability is specific to Linux kernel versions containing the affected commit and is relevant to systems running ARM64 Linux kernels with KASAN enabled, particularly with CONFIG_KASAN_STACK. No known exploits are reported in the wild, and the issue primarily causes kernel instability and false memory error reports rather than direct code execution or privilege escalation.

For European organizations, the impact of CVE-2024-36906 is primarily related to system stability and reliability on ARM64-based Linux systems with KASAN enabled. While this vulnerability does not directly lead to remote code execution or privilege escalation, it can cause kernel crashes and system instability due to false-positive memory error detections. This can disrupt critical services, especially in environments relying on ARM64 servers, embedded devices, or IoT infrastructure running Linux kernels with KASAN instrumentation. Organizations using ARM64 Linux in data centers, edge computing, or industrial control systems may experience increased downtime or require additional maintenance to apply patches. The false KASAN alerts may also complicate debugging and incident response efforts, potentially delaying detection of genuine memory corruption issues. Since the vulnerability is tied to kernel internals and CPU idle state transitions, it is less likely to be exploited remotely but could affect system reliability and operational continuity in sensitive deployments.

To mitigate CVE-2024-36906, European organizations should: 1) Apply the official Linux kernel patches that clear stale stack poison during CPU idle transitions, specifically those referenced in commits 0d97e6d8024c and d56a9ef84bd0. 2) Upgrade to a Linux kernel version that includes these fixes, ensuring the kernel is rebuilt with CONFIG_KASAN_STACK enabled if KASAN is used. 3) For systems where KASAN is not required in production, consider disabling KASAN to avoid this issue altogether, as KASAN is primarily a debugging tool. 4) Monitor kernel logs for KASAN-related errors or OOB crashes to detect any residual issues. 5) Test kernel updates in staging environments to verify stability before deployment. 6) For embedded or ARM64-based devices, coordinate with hardware vendors to obtain updated firmware or kernel images incorporating the fix. 7) Maintain robust backup and recovery procedures to minimize downtime in case of kernel crashes. These steps go beyond generic advice by focusing on kernel patch application, configuration management, and operational monitoring specific to ARM64 Linux systems with KASAN enabled.