CVE-2024-58088 is a vulnerability in the Linux kernel related to the Berkeley Packet Filter (BPF) subsystem, specifically involving cgroup storage management. The issue arises from a deadlock condition when freeing cgroup storage in BPF programs. Initially, a commit introduced deadlock prevention for task storage helpers in BPF programs attaching to function entry/exit points (fentry/fexit). However, when cgroup storage (bpf_cgrp_storage) was introduced later, it reused similar logic but incorrectly passed a NULL busy counter to the free procedure instead of a valid counter. This omission created a window where a deadlock could occur during concurrent operations involving local storage locking and freeing of cgroup storage. The deadlock manifests when a BPF program (Prog A) that attaches to cgroup storage pointers attempts to access or update storage while another BPF program (Prog B) repeatedly creates and destroys cgroup storage entries in a tight loop. The deadlock is triggered because the freeing procedure does not properly increment the busy counter before acquiring locks, causing recursive locking attempts and system stalls. The vulnerability affects Linux kernel versions containing the specific commit introducing bpf_cgrp_storage (commit c4bcfb38a95e). The fix involves passing the busy counter correctly to the free procedure, allowing proper lock management and preventing deadlocks. This vulnerability is significant because BPF is widely used for performance monitoring, security enforcement, and networking in Linux environments, and cgroup storage is a mechanism to associate data with control groups for resource management and isolation. Exploiting this deadlock could lead to kernel hangs or denial of service conditions, impacting system availability. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions with BPF cgroup storage enabled and in use. Many enterprises, cloud providers, and service operators in Europe rely heavily on Linux for servers, container orchestration (e.g., Kubernetes), and network functions where BPF programs are common. A deadlock in the kernel can cause system hangs or crashes, leading to denial of service (DoS) conditions. This can disrupt critical services, including web hosting, cloud infrastructure, telecommunications, and industrial control systems. The impact is particularly relevant for organizations using advanced BPF-based monitoring, security, or networking tools that utilize cgroup storage. While the vulnerability does not appear to allow privilege escalation or data leakage directly, the availability impact can be severe in high-availability environments. Additionally, the complexity of the exploit scenario (requiring specific BPF programs running in a loop) may limit widespread exploitation but does not eliminate risk in targeted attacks or misconfigurations. Systems running containerized workloads or multi-tenant environments are at higher risk due to frequent use of cgroups and BPF for resource and security management.

European organizations should prioritize updating their Linux kernels to versions that include the fix for CVE-2024-58088. Since the vulnerability stems from a specific commit, applying the latest stable kernel releases or vendor-provided patches that address this issue is critical. Organizations using custom or long-term support kernels should monitor vendor advisories and backport patches as needed. Additionally, administrators should audit BPF programs deployed in their environments, especially those using cgroup storage helpers, to understand if they could trigger the deadlock scenario. Limiting or controlling the deployment of BPF programs that aggressively create and destroy cgroup storage entries can reduce risk. Implementing runtime monitoring for kernel hangs or unusual BPF activity may help detect attempts to exploit this vulnerability. For container orchestration platforms, ensure that node kernels are patched and that BPF programs deployed by monitoring or security tools are updated accordingly. Finally, consider isolating critical workloads on patched systems and avoid running untrusted BPF programs that could trigger the deadlock.