CVE-2024-58057 addresses a performance and stability vulnerability in the Linux kernel's handling of workqueues, specifically related to the Intel Data Plane Development Kit (IDPF) driver. The vulnerability arises from the way workqueues are scheduled when created with the WQ_UNBOUND flag. Normally, WQ_UNBOUND workqueues allow work items to be executed on any CPU within the same NUMA node, which helps avoid CPU contention and improves performance by not binding work items to a specific CPU. However, in the default or misconfigured scenarios where work items are forced to run on a specific CPU (e.g., CPU0), a misbehaving or CPU-intensive process can monopolize that CPU, starving the kernel worker threads (kworkers) responsible for processing the workqueue. This leads to significant delays in workqueue execution, causing performance degradation, timeouts, and potentially system crashes. The vulnerability was demonstrated by running a high-priority antagonist process bound to CPU0, which consumed nearly all CPU time, leaving less than 0.5% for the kworker. This caused IDPF workqueues tied to CPU0 to experience delays up to 30 milliseconds between queuing and execution of work items. The patch converts the IDPF workqueues to unbound, allowing the kernel to migrate work items to less loaded CPUs within the same node, drastically reducing delays to as low as 6 microseconds. This fix improves system responsiveness and stability under CPU contention scenarios. While this vulnerability does not directly expose a security breach such as privilege escalation or data leakage, it can cause denial of service through system instability and crashes due to delayed processing of critical kernel work. The issue is particularly relevant for systems running workloads that heavily rely on the IDPF driver and kernel workqueues, especially in environments with CPU-intensive processes that may inadvertently or maliciously starve kernel workers on specific CPUs.

For European organizations, the impact of CVE-2024-58057 can be significant in environments where Linux servers are used for high-performance networking, data processing, or virtualization that leverage the IDPF driver. Delays in kernel workqueue processing can degrade application performance, cause timeouts, and lead to system crashes, resulting in downtime and potential disruption of critical services. This is especially critical for sectors such as telecommunications, financial services, cloud providers, and data centers that rely on Linux-based infrastructure for low-latency and high-throughput operations. The vulnerability could also affect embedded Linux systems used in industrial control or IoT devices, where stability is paramount. Although no known exploits are reported in the wild, the vulnerability could be triggered unintentionally by resource-heavy workloads or intentionally by attackers aiming to cause denial of service through CPU starvation.

1. Apply the official Linux kernel patch that converts the IDPF workqueues to unbound, allowing work items to migrate to less loaded CPUs within the same NUMA node. 2. Review and adjust CPU affinity settings for critical processes and kernel workqueues to avoid binding work items to heavily loaded CPUs. 3. Implement CPU resource management policies using cgroups or similar mechanisms to prevent any single process from monopolizing CPU resources, especially on CPUs handling kernel workqueues. 4. Monitor CPU usage and kernel workqueue latency metrics to detect abnormal delays or CPU starvation conditions. 5. For systems running critical workloads with IDPF drivers, consider kernel version upgrades that include this fix and related performance improvements. 6. Conduct stress testing in controlled environments to validate system behavior under high CPU load scenarios and ensure that workqueue delays remain within acceptable limits. 7. Educate system administrators about the risks of CPU pinning and high-priority processes that may impact kernel worker threads.