CVE-2024-50249 is a vulnerability identified in the Linux kernel related to the Advanced Configuration and Power Interface (ACPI) CPPC (Collaborative Processor Performance Control) subsystem. The issue arises from improper locking mechanisms within the kernel code, specifically involving the rmw_lock, which was originally not a raw_spin_lock. The vulnerability manifests as a BUG triggered by an invalid wait context during concurrent operations on kernel worker threads. The root cause is a locking order and type mismatch: the function sugov_update_shared() locks a raw_spinlock, while cpc_write() locks a spinlock, leading to potential deadlocks or kernel panics. The fix involves converting rmw_lock to a raw_spin_lock and ensuring that interrupts are disabled on the CPU holding this lock to maintain correct wait-type order and prevent invalid wait contexts. This vulnerability affects multiple Linux kernel versions identified by specific commit hashes and is present in kernel version 6.12.0-rc2 and related builds. Although no known exploits are currently reported in the wild, the issue can cause system instability or crashes due to kernel BUGs triggered by improper locking in power management code paths. The vulnerability is technical and low-level, impacting kernel synchronization primitives critical for CPU frequency scaling and power management.

For European organizations relying on Linux-based infrastructure, this vulnerability could lead to unexpected system crashes or kernel panics, particularly on servers or embedded systems utilizing affected kernel versions. Such instability can disrupt critical services, degrade availability, and increase operational costs due to downtime and troubleshooting efforts. Organizations running high-performance computing, cloud services, or telecommunications infrastructure on Linux kernels in the affected versions may experience reliability issues. While the vulnerability does not directly expose confidentiality or integrity risks, the availability impact can be significant, especially in environments requiring high uptime. Additionally, the complexity of the vulnerability means that exploitation requires triggering specific kernel code paths, which may limit widespread exploitation but does not eliminate risk. European entities with large-scale Linux deployments, including public sector, financial institutions, and industrial control systems, should be aware of potential disruptions. The lack of known exploits reduces immediate threat but patching remains critical to maintain system stability and prevent future exploitation attempts.

1. Immediate application of the official Linux kernel patches that convert rmw_lock to a raw_spin_lock and disable interrupts on the CPU holding the lock. Monitor Linux kernel mailing lists and vendor advisories for updated stable kernel releases containing this fix. 2. For organizations unable to upgrade immediately, consider temporarily disabling or limiting workloads that heavily utilize CPU frequency scaling or power management features tied to CPPC to reduce exposure. 3. Implement rigorous kernel crash monitoring and alerting to detect early signs of this bug manifesting in production systems. 4. Conduct thorough regression testing in staging environments after patching to ensure no adverse effects on system performance or stability. 5. Maintain up-to-date kernel versions and subscribe to security advisories from Linux distributions commonly used in Europe (e.g., Debian, Ubuntu, Red Hat, SUSE) to receive timely updates. 6. For embedded or specialized Linux systems, coordinate with hardware vendors to obtain patched kernel versions or firmware updates addressing this issue. 7. Document and review kernel configuration options related to ACPI and CPPC to understand exposure scope and adjust configurations if feasible to mitigate risk.