CVE-2024-57849 is a vulnerability identified in the Linux kernel specifically affecting the s390 architecture's CPU sampling functionality during CPU hotplug events. The issue arises when a CPU is removed (hotplugged off) while a performance monitoring event is still active on that CPU. The kernel's performance monitoring unit (PMU) sampling driver for s390 CPUs deallocates the sample data buffers (SDBs) associated with the CPU during the CPU hotplug removal process. However, the event removal sequence subsequently attempts to read from these buffers, which have already been freed. This leads to a use-after-free condition where the driver may access invalid or reallocated memory, potentially causing data corruption or kernel instability. The root cause is that the kernel does not properly check whether the CPU's PMU sampling buffers are still reserved before attempting to read from them during event removal. The fix involves verifying the PMU_F_RESERVED bit to confirm if the buffers are still valid before accessing them. If the bit is not set, the buffers have been released and should not be accessed. This vulnerability is specific to the s390 architecture's CPU sampling subsystem and involves kernel internal handling of CPU hotplug events and performance monitoring. No known exploits are reported in the wild, and the vulnerability was published on January 11, 2025. The affected versions are identified by a specific commit hash, indicating a narrow scope tied to particular kernel builds.

For European organizations, the impact of CVE-2024-57849 depends largely on their use of Linux systems running on IBM s390 mainframe architectures, which are less common than x86 or ARM architectures but are used in certain enterprise and financial sectors. The vulnerability could lead to kernel crashes or instability due to use-after-free memory access during CPU hotplug events, potentially causing denial of service or system outages. This could disrupt critical workloads, especially in environments relying on high availability and performance monitoring on s390 systems. Although the vulnerability does not directly lead to privilege escalation or data leakage, the instability could indirectly affect confidentiality and integrity by causing unexpected system behavior or crashes. European organizations in sectors such as banking, government, and large-scale enterprise IT that utilize s390 mainframes for critical operations could face operational risks if this vulnerability is exploited or triggered unintentionally. Given the lack of known exploits, the immediate threat is low, but the potential for system disruption warrants timely patching.

European organizations using Linux on s390 architectures should prioritize applying the official kernel patches that address this vulnerability by correctly checking the PMU_F_RESERVED bit before accessing sample data buffers during CPU hotplug events. System administrators should audit their kernel versions against the affected commit hashes and upgrade to patched versions as soon as they become available. Additionally, organizations should implement robust monitoring of kernel logs and performance monitoring subsystems to detect anomalies related to CPU hotplug events or PMU sampling. Testing kernel updates in staging environments that replicate production s390 workloads is recommended to ensure stability before deployment. Where possible, limiting CPU hotplug operations during critical performance monitoring activities can reduce the risk of triggering the vulnerability. Finally, maintaining up-to-date backups and recovery procedures for s390 systems will help mitigate the impact of any unexpected system crashes.