CVE-2024-39474 is a vulnerability in the Linux kernel's memory management subsystem, specifically related to the vmalloc function and its handling of the __GFP_NOFAIL flag during memory allocation. The issue arises from a conflict between two kernel commits: one that introduced support for __GFP_NOFAIL in kvmalloc allocations, and another that added a check for fatal signals (such as those sent by the Out-Of-Memory (OOM) killer) during page allocation in vm_area_alloc_pages(). Normally, when a process is OOM-killed, the kernel sets a fatal signal pending flag, causing vmalloc to return NULL to indicate allocation failure. However, the __GFP_NOFAIL flag is intended to guarantee allocation success by retrying indefinitely. The conflict means that vmalloc may incorrectly return NULL even when __GFP_NOFAIL is set, violating the assumption that allocations with this flag never fail. This can lead to NULL pointer dereferences in kernel code that assumes successful allocation, causing kernel panics and system crashes. The vulnerability was discovered during OPLUS KASAN testing and is exemplified by a kernel panic in the erofs filesystem code path, where kvcalloc is called with GFP_KERNEL | __GFP_NOFAIL flags and the returned NULL pointer is dereferenced. The fix involves modifying vm_area_alloc_pages() to skip the fatal_signal_pending() check when __GFP_NOFAIL is set, ensuring that allocations either succeed or the system handles failure appropriately without returning NULL unexpectedly. This vulnerability affects Linux kernel versions identified by the given commit hashes and is relevant to any Linux-based system using affected kernel versions. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk of system instability and denial of service due to kernel panics triggered by NULL pointer dereferences during memory allocation. Systems running affected Linux kernel versions, especially those using filesystems like erofs or relying on memory allocations with __GFP_NOFAIL, may experience unexpected crashes. This can disrupt critical services, particularly in environments with high memory pressure or constrained resources where the OOM killer is active. The impact is more pronounced for servers, cloud infrastructure, and embedded devices running Linux kernels with the vulnerable code. Confidentiality and integrity impacts are minimal since the vulnerability primarily causes availability issues through system crashes. However, availability disruptions can have cascading effects on business operations, service delivery, and compliance with European data protection regulations requiring high availability and resilience. Organizations using Linux-based infrastructure in sectors such as finance, healthcare, telecommunications, and public services should be particularly vigilant. The absence of known exploits reduces immediate risk but patching is essential to prevent potential future exploitation or accidental system failures.

European organizations should promptly identify Linux systems running affected kernel versions by checking kernel commit hashes or vendor advisories. Applying the official Linux kernel patches that address this issue is the primary mitigation step. If immediate patching is not feasible, organizations should monitor system logs for OOM killer activity and kernel panics related to vmalloc or erofs filesystem operations. Reducing memory pressure by optimizing application memory usage, increasing available memory, or tuning OOM killer behavior can mitigate triggering conditions. For critical systems, consider deploying kernel live patching solutions to minimize downtime. Additionally, testing kernel updates in staging environments before production deployment is recommended to ensure stability. Organizations should also review and update incident response plans to handle potential availability incidents caused by this vulnerability. Collaboration with Linux distribution vendors for timely security updates and guidance is advised. Finally, maintaining comprehensive backups and high availability configurations can reduce the operational impact of unexpected kernel crashes.