CVE-2024-56589 is a vulnerability identified in the Linux kernel specifically affecting the hisi_sas driver, which manages SAS (Serial Attached SCSI) storage devices on HiSilicon hardware platforms. The issue arises in Linux kernels configured with a no forced preemption model when an expander is connected to multiple high-performance SAS SSDs (up to 12 in the described scenario). Under these conditions, the driver’s hardware interrupt handler and the interrupt thread execute on the same CPU core. The function irq_wait_for_interrupt() continuously returns 0 due to frequent interrupts, causing the CPU to be consumed indefinitely in interrupt handling. This prevents the Linux watchdog thread from running, leading to a soft lockup where the CPU appears stuck for an extended period (e.g., 22 seconds as shown in the call trace). The lockup manifests as a kernel bug detected by the watchdog, resulting in system instability and potential denial of service. The root cause is the lack of a conditional reschedule (cond_resched()) call in the interrupt handling path, which would allow the scheduler to run other tasks, including the watchdog. The fix involves adding cond_resched() to the hisi_sas driver code to ensure that the CPU can yield to the watchdog thread and prevent lockups. This vulnerability is not related to memory corruption or privilege escalation but rather to CPU scheduling and interrupt handling inefficiency under heavy SAS SSD load on specific hardware and kernel configurations.

For European organizations, particularly those using Linux servers with HiSilicon SAS controllers managing multiple high-performance SAS SSDs, this vulnerability can cause system instability and downtime due to CPU soft lockups. Such lockups can disrupt critical storage operations, impacting data availability and potentially causing denial of service in storage-heavy environments like data centers, cloud providers, and enterprises relying on high-speed SAS storage arrays. The impact is primarily on availability rather than confidentiality or integrity. Organizations running Linux kernels with no forced preemption models on affected hardware may experience degraded performance or system crashes under heavy I/O loads. This can affect business continuity, especially in sectors with stringent uptime requirements such as finance, telecommunications, and manufacturing. Since the vulnerability does not require user interaction or authentication, any workload triggering heavy SAS SSD I/O on vulnerable systems is at risk. However, the exploitability is limited to specific hardware and kernel configurations, reducing the overall attack surface.

European organizations should first identify if their Linux systems use the hisi_sas driver with no forced preemption kernel models and are connected to multiple high-performance SAS SSDs, particularly on HiSilicon hardware platforms. Applying the official Linux kernel patches that add cond_resched() in the hisi_sas driver is the primary mitigation step. If patches are not immediately available, organizations can consider temporarily switching to a forced preemption kernel model if feasible, to avoid the CPU starvation scenario. Monitoring system logs for soft lockup warnings and CPU stalls related to irq/149-hisi_sa interrupts can help detect attempts to trigger this issue. Additionally, workload balancing to reduce simultaneous SAS SSD I/O on affected systems can mitigate the risk. For critical environments, testing kernel updates in staging before production deployment is recommended to ensure stability. Vendors and Linux distributions should be engaged to provide timely patched kernel releases. Finally, organizations should maintain robust backup and disaster recovery plans to mitigate potential availability impacts from system instability.