CVE-2024-35996

What it actually does

The flaw causes CPU mitigations to remain disabled by default on non-x86 architectures due to incorrect Kconfig dependencies after renaming SPECULATION_MITIGATIONS, leaving speculative execution and side-channel protections off at compile time.

Why it matters to the business

Non-x86 Linux systems may operate without required CPU protections, raising exposure to local information disclosure or denial-of-service attacks from unmitigated processor flaws and necessitating immediate kernel updates across affected fleets.

How an attack unfolds

An attacker obtains local access on a non-x86 system built from a vulnerable kernel, then leverages unmitigated CPU speculation or side-channel weaknesses to read sensitive data or crash the system; the configuration error prevents default enablement of mitigations that would otherwise block the attack.

How to fix it

Upgrade the Linux kernel to version 5.15.158 or apply commit af6d6a923b40bf6471e44067ac61cc5814b48e7f to correctly define and force CPU_MITIGATIONS on for non-x86 architectures.

How to confirm the fix worked

Inspect the kernel .config for CONFIG_CPU_MITIGATIONS=y, boot the updated kernel, and confirm mitigation status files under /sys/devices/system/cpu/vulnerabilities/ report mitigated rather than vulnerable on non-x86 hardware.

Typical attack path

1. Locate non-x86 Linux hosts running an affected kernel build
2. Obtain local user privileges
3. Trigger unmitigated CPU speculation or side-channel primitive to disclose data or cause denial of service

How to detect it

Review kernel build logs and .config files for absence of CPU_MITIGATIONS; examine runtime files under /sys/devices/system/cpu/vulnerabilities/ on non-x86 systems for 'Vulnerable' status indicating missing mitigations.

• /sys/devices/system/cpu/vulnerabilities/*/Vulnerable
• CONFIG_CPU_MITIGATIONS is not set or set to n in kernel config
• Kernel command line lacking mitigations=auto or equivalent

What your security team should do

• Immediately rebuild and deploy kernels containing the fix to all non-x86 systems
• Audit existing kernel build configurations to ensure CPU_MITIGATIONS is enabled
• Verify mitigation status at runtime across the fleet after patching