CVE-2024-50140 is a vulnerability identified in the Linux kernel, specifically related to the scheduler's handling of task work in the function task_tick_mm_cid(). This function was introduced in Linux kernel version 6.4 as part of a commit aimed at fixing a performance regression related to memory management context IDs (mm_cid). The vulnerability arises when Kernel Address Sanitizer (KASAN) and PREEMPT_RT (a real-time kernel patch) are enabled. Under these conditions, calling task_work_add() within task_tick_mm_cid() can lead to a kernel BUG due to a sleeping function being called from an invalid context while holding a raw spinlock (rq->__lock). The kernel log shows that the system attempts to allocate pages (alloc_pages()) during stack depot operations (stack_depot_save_flags()), which is not allowed while holding this spinlock because it can sleep, violating kernel locking rules and causing a crash (splat). The root cause is that task_work_add() triggers kasan_record_aux_stack(), which attempts to allocate memory for stack traces, but allocation is disallowed in this context. The fix involves introducing a new flag (TWAF_NO_ALLOC) to task_work_add() that prevents page allocation by using a variant function kasan_record_aux_stack_noalloc(), which does not allocate new pages and thus avoids the invalid sleep context. This fix prevents kernel crashes but may result in missing stack traces in KASAN reports when page allocation would have been necessary, though this scenario is expected to be rare. No known exploits are reported in the wild, and the vulnerability is primarily a stability and reliability issue rather than a direct security compromise vector such as privilege escalation or information disclosure.

For European organizations, the impact of CVE-2024-50140 primarily concerns system stability and reliability, especially for those running Linux kernels with KASAN and PREEMPT_RT enabled. These configurations are common in development, testing, and real-time environments such as telecommunications, industrial control systems, and embedded devices. A kernel crash due to this vulnerability could lead to denial of service (DoS) conditions, affecting availability of critical systems. While it does not directly enable unauthorized access or data leakage, the resulting system instability can disrupt operations, cause downtime, and increase maintenance costs. Organizations relying on real-time Linux kernels for critical infrastructure or industrial automation may experience operational interruptions. Additionally, missing stack traces in KASAN reports could hinder debugging and vulnerability detection efforts, potentially delaying identification of other issues. However, since exploitation requires specific kernel configurations and conditions, the overall risk to general-purpose Linux deployments is limited.

European organizations should apply the official Linux kernel patches that introduce the TWAF_NO_ALLOC flag and modify task_tick_mm_cid() to avoid page allocation during task_work_add() calls. For systems using PREEMPT_RT and KASAN, upgrading to kernel versions including this fix is critical. Organizations should audit their kernel configurations to identify if KASAN and PREEMPT_RT are enabled, as this vulnerability only manifests under these conditions. For real-time and embedded Linux deployments, thorough testing of updated kernels is recommended to ensure stability and compatibility. Additionally, monitoring kernel logs for BUG messages related to sleeping functions in invalid contexts can help detect attempts to trigger this issue. Where immediate patching is not feasible, temporarily disabling KASAN or PREEMPT_RT (if operationally acceptable) can mitigate risk. Finally, maintain robust backup and recovery procedures to minimize downtime in case of kernel crashes.