CVE-2024-50064 is a vulnerability identified in the Linux kernel's zram subsystem, specifically related to memory management of secondary algorithm names when resetting a zram device configured with multi-streams. Zram is a kernel module that provides compressed RAM-based block devices, often used to improve system performance by compressing pages in memory. The vulnerability arises because the kernel code fails to free (kfree) the memory allocated for secondary algorithm names during a reset operation on zram devices with multi-stream configurations. This results in a memory leak, where allocated memory is not properly released back to the system. Although the kernel function kfree(NULL) is legal and safe, the issue is that the allocated memory for secondary algorithm names is not freed at all, leading to gradual memory consumption over time. The flaw does not appear to allow direct code execution or privilege escalation but can degrade system performance or stability due to memory exhaustion if exploited or triggered repeatedly. The vulnerability has been addressed by ensuring that the kernel properly frees the secondary algorithm names during the reset process. No known exploits are reported in the wild at this time, and no CVSS score has been assigned yet. The affected versions are identified by specific commit hashes, indicating that this is a recent and low-level kernel issue.

For European organizations, the impact of CVE-2024-50064 primarily concerns system stability and resource availability rather than direct compromise of confidentiality or integrity. Systems running Linux kernels with vulnerable zram implementations, especially those utilizing multi-stream zram devices, may experience memory leaks leading to gradual degradation in performance or potential system crashes under heavy or prolonged usage. This could affect servers, embedded devices, or desktops relying on zram for memory compression. Organizations with critical infrastructure or services that depend on Linux-based systems may face availability risks if the memory leak leads to resource exhaustion. While the vulnerability does not currently enable remote code execution or privilege escalation, denial-of-service conditions caused by memory leaks can disrupt operations. European entities in sectors such as telecommunications, cloud services, and manufacturing that use Linux extensively should be aware of this risk. However, the absence of known exploits and the technical nature of the vulnerability suggest a moderate risk level at present.

To mitigate CVE-2024-50064, organizations should promptly apply the latest Linux kernel patches that address the zram memory leak issue. Since the vulnerability is fixed by ensuring proper memory deallocation in the kernel code, updating to a patched kernel version is the most effective measure. System administrators should: 1) Identify Linux systems using zram with multi-stream configurations, particularly in production environments. 2) Monitor system memory usage for unusual growth patterns that could indicate leaks. 3) Schedule kernel updates during maintenance windows to minimize disruption. 4) For environments where immediate patching is not feasible, consider disabling zram multi-stream features temporarily if possible, to reduce exposure. 5) Employ system monitoring and alerting tools to detect early signs of memory exhaustion. 6) Engage with Linux distribution vendors or maintainers to obtain timely security updates. These steps go beyond generic advice by focusing on the specific subsystem and configuration implicated in the vulnerability.