CVE-2024-53195 is a vulnerability identified in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for the ARM64 architecture. The issue arises from improper management of the userspace_irqchip_in_use static key, which is used to track whether a userspace IRQ chip is in use. The vulnerability manifests when userspace creates a virtual machine (VM) and a virtual CPU (vCPU), initializes the vCPU with the KVM_ARM_VCPU_PMU_V3 flag during KVM_ARM_VCPU_INIT, but does not fully set up required components such as the virtual Generic Interrupt Controller (vGIC) or virtual Performance Monitoring Unit (vPMU). When userspace issues the KVM_RUN command on the vCPU, the kernel attempts to enable the vPMU but fails because it is not properly initialized, causing kvm_arm_pmu_v3_enable() to return an error. Despite this failure, the timer is enabled but the userspace_irqchip_in_use counter is not incremented as expected. If userspace ignores this error and issues KVM_ARM_VCPU_INIT again, the kernel's timer reset function (kvm_timer_vcpu_reset) calls kvm_timer_update_irq, which checks the userspace_irqchip_in_use state. Due to the mismanagement of this static key, the kernel triggers a WARN_ON() condition, indicating an unexpected state that could lead to instability or denial of service. The root cause is the improper use and management of the userspace_irqchip_in_use static key, which the patch replaces with a more reliable check using !irqchip_in_kernel() to avoid this mismanagement and the associated kernel warnings. This vulnerability is specific to ARM64 KVM implementations and affects Linux kernel versions identified by the commit hash 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2. There are no known exploits in the wild, and no CVSS score has been assigned yet. The issue was discovered through syzbot fuzz testing, which triggered the WARN_ON() condition during kernel execution.

For European organizations, the impact of CVE-2024-53195 primarily concerns environments running ARM64-based Linux systems with KVM virtualization enabled. This includes cloud providers, telecom operators, and enterprises deploying ARM64 servers or edge computing devices. The vulnerability can cause kernel warnings that may lead to system instability or crashes, potentially resulting in denial of service (DoS) conditions on virtualized workloads. This can disrupt critical services, especially in sectors relying on ARM64 infrastructure such as telecommunications (5G infrastructure), IoT deployments, and cloud-native applications. Although there is no evidence of privilege escalation or arbitrary code execution, the instability caused by this vulnerability could be exploited by attackers to degrade service availability or cause unexpected reboots. European organizations with ARM64-based virtualization platforms should be aware that ignoring error returns from KVM ioctl calls can trigger this vulnerability. The lack of known exploits reduces immediate risk, but the potential for DoS in critical infrastructure warrants prompt attention. Furthermore, the complexity of the issue means that debugging and recovery may require specialized kernel knowledge, increasing operational overhead for affected organizations.

To mitigate CVE-2024-53195, European organizations should: 1) Apply the latest Linux kernel patches that remove the userspace_irqchip_in_use static key and replace it with the more reliable !irqchip_in_kernel() check, as indicated by the upstream fix. 2) Ensure that userspace virtualization management tools properly handle errors returned by KVM ioctl calls, especially during vCPU initialization and KVM_RUN commands, to avoid ignoring failures that lead to inconsistent kernel states. 3) Audit and update virtualization orchestration scripts and management software to verify complete setup of vGIC and vPMU components before running vCPUs with KVM_ARM_VCPU_PMU_V3 enabled. 4) Monitor kernel logs for WARN_ON() messages related to kvm_timer_update_irq and kvm_timer_vcpu_reset to detect any attempts to trigger this vulnerability. 5) For critical production environments, consider implementing runtime kernel integrity monitoring and automated rollback mechanisms to quickly recover from potential DoS conditions caused by this vulnerability. 6) Engage with Linux distribution vendors and cloud providers to confirm that their kernel versions include the fix and that their ARM64 virtualization stacks are updated accordingly.