CVE-2024-53090 is a vulnerability identified in the Linux kernel related to the AFS (Andrew File System) implementation, specifically within the afs_wake_up_async_call() function. The issue arises due to lock recursion involving the ->notify_lock spinlock. When afs_wake_up_async_call() is invoked from the AF_RXRPC context while holding the ->notify_lock, it attempts to take a reference on the afs_call structure to pass it to a work queue. If the afs_call is already queued, an extraneous reference is created that must be released. The release operation, afs_put_call(), can call back into AF_RXRPC via rxrpc_kernel_shutdown_call(), which attempts to reacquire the ->notify_lock. This recursive lock acquisition leads to a spinlock recursion bug, which is a serious kernel-level synchronization error causing kernel oops or crashes. The vulnerability is not common but can cause system instability or denial of service due to kernel panic or deadlock. The provided kernel oops trace confirms the spinlock recursion on CPU0, showing the call stack leading to the issue. The fix involves deferring the problematic call to a workqueue to avoid recursive locking. This vulnerability affects Linux kernel versions prior to the patch and is relevant to systems using AFS and RXRPC subsystems. There are no known exploits in the wild, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2024-53090 primarily concerns systems running Linux kernels with AFS and RXRPC enabled, which are typically found in enterprise environments utilizing distributed file systems or legacy network file sharing solutions. The vulnerability can lead to kernel crashes or system instability, resulting in denial of service (DoS). This can disrupt critical services, especially in sectors relying on high availability such as finance, telecommunications, healthcare, and government infrastructure. Although exploitation does not appear trivial and requires specific kernel configurations, affected systems may experience unexpected downtime, impacting business continuity and operational efficiency. Confidentiality and integrity impacts are minimal since the vulnerability is related to locking and resource management rather than direct data exposure or privilege escalation. However, availability degradation can indirectly affect security posture by causing service interruptions and potential cascading failures in dependent systems.

To mitigate CVE-2024-53090, European organizations should: 1) Apply the latest Linux kernel patches that address this vulnerability as soon as they become available, prioritizing systems with AFS and RXRPC enabled. 2) Audit and identify systems running affected kernel versions, focusing on those utilizing AFS for file sharing or network communication. 3) Where patching is not immediately feasible, consider disabling AFS or RXRPC modules if they are not critical to operations to reduce exposure. 4) Implement robust monitoring for kernel oops or unusual system crashes that may indicate triggering of this vulnerability. 5) Test patches in controlled environments to ensure stability before wide deployment, given the kernel-level nature of the fix. 6) Maintain updated incident response plans to quickly address potential DoS events caused by this or similar kernel issues. 7) Collaborate with Linux distribution vendors and security communities for timely updates and advisories.