CVE-2024-40947 is a vulnerability in the Linux kernel's Integrity Measurement Architecture (IMA) subsystem, specifically related to the handling of Read-Copy-Update (RCU) read-side critical sections. The flaw arises from a recent commit (c7423dbdbc9e) that introduced a call to ima_lsm_copy_rule within an RCU read-side critical section. This call performs a kmalloc with GFP_KERNEL allocation, which can sleep, violating the constraints of RCU read-side critical sections on non-PREEMPT kernels. Sleeping in this context can cause synchronize_rcu() to return prematurely, breaking RCU protection and potentially leading to a use-after-free (UAF) condition. The vulnerability manifests as a kernel panic due to a NULL pointer dereference in the ima_match_policy function, which attempts to access a freed or invalid memory entry. The root cause is a race condition between two threads: one holding an RCU read lock and performing a kmalloc that sleeps, and another thread freeing the memory entry. This results in the first thread accessing a stale pointer, causing system instability or crash. The fix involves converting kmalloc calls within RCU read-side critical sections to use GFP_ATOMIC, which does not sleep, thus preserving RCU guarantees. This vulnerability affects multiple Linux kernel versions identified by specific commit hashes and is particularly relevant for systems using IMA and running non-PREEMPT kernels. No known exploits are reported in the wild as of the publication date.

For European organizations, this vulnerability poses a significant risk to the stability and reliability of Linux-based systems, especially those running kernel versions affected by this flaw and utilizing IMA for security policy enforcement. Systems such as servers, cloud infrastructure, container hosts (e.g., Kubernetes nodes), and embedded devices relying on Linux kernels could experience unexpected kernel panics leading to denial of service (DoS). This can disrupt critical business operations, cause downtime, and potentially impact services that require high availability. Additionally, the vulnerability could be leveraged in multi-tenant environments to destabilize shared infrastructure. Although no direct code execution or privilege escalation is indicated, the resulting DoS and system crashes can have cascading effects on confidentiality and integrity by interrupting security monitoring and enforcement mechanisms. Given the widespread use of Linux in European data centers, telecom infrastructure, and industrial control systems, the impact could be broad if unpatched systems are exploited or triggered inadvertently.

European organizations should prioritize updating their Linux kernels to versions that include the fix for CVE-2024-40947, ensuring that all affected systems are patched promptly. Specifically, kernel versions incorporating the commit that replaces GFP_KERNEL with GFP_ATOMIC in RCU read-side critical sections should be deployed. For environments where immediate patching is not feasible, organizations should consider disabling IMA if it is not critical to their security posture, as this may mitigate the risk of triggering the vulnerability. Additionally, monitoring kernel logs for signs of the described panic or NULL pointer dereference can help detect attempts to exploit or inadvertently trigger the issue. Organizations should also review their kernel configuration to prefer PREEMPT or PREEMPT_RT kernels where possible, as these may reduce the risk of sleeping in RCU critical sections. Finally, implementing robust system monitoring and automated recovery mechanisms can help minimize downtime caused by kernel panics.