CVE-2024-35996: cpu: Re-enable CPU mitigations by default for !X86 architectures
In the Linux kernel, the following vulnerability has been resolved:
cpu: Re-enable CPU mitigations by default for !X86 architectures
Rename x86's to CPU_MITIGATIONS, define it in generic code, and force it
on for all architectures exception x86. A recent commit to turn
mitigations off by default if SPECULATION_MITIGATIONS=n kinda sorta
missed that "cpu_mitigations" is completely generic, whereas
SPECULATION_MITIGATIONS is x86-specific.
Rename x86's SPECULATIVE_MITIGATIONS instead of keeping both and have it
select CPU_MITIGATIONS, as having two configs for the same thing is
unnecessary and confusing. This will also allow x86 to use the knob to
manage mitigations that aren't strictly related to speculative
execution.
Use another Kconfig to communicate to common code that CPU_MITIGATIONS
is already defined instead of having x86's menu depend on the common
CPU_MITIGATIONS. This allows keeping a single point of contact for all
of x86's mitigations, and it's not clear that other architectures *want*
to allow disabling mitigations at compile-time.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue could leave CPU security mitigations disabled by default on non-x86 systems because a mitigation configuration setting was treated as x86-specific. The business concern is reduced protection on affected Linux hosts or appliances, especially ARM or other non-x86 platforms. The bundle provides no CVSS score and no evidence of active exploitation.
Executive priority
Treat as a medium-priority hardening and platform hygiene issue. It is not presented as actively exploited, but it can silently weaken defenses on non-x86 Linux platforms. Patch through normal kernel and appliance maintenance cycles, with faster handling for internet-facing, multi-tenant, or sensitive workloads.
Technical view
The fix makes CPU_MITIGATIONS generic, forces it on for non-x86 architectures, and has x86 select it through its own mitigation menu. The resolved bug came from a prior change where SPECULATION_MITIGATIONS was x86-specific but cpu_mitigations was generic, causing mitigations to default off outside x86.
Likely exposure
Most relevant exposure is Linux on non-x86 architectures built from vulnerable kernel revisions before the stable fixes. Exact vulnerable version ranges are not fully described in the bundle. Vendor appliances using Linux kernels may also be affected, as reflected by Siemens advisories.
Exploitation context
The bundle does not cite KEV listing, public exploitation, exploit code, or a direct remote attack path. This is a hardening-regression vulnerability: impact depends on architecture, kernel build configuration, and whether CPU mitigation controls were unintentionally disabled.
Researcher notes
Evidence supports a configuration/defaults regression in Linux CPU mitigation handling, not a standalone exploit primitive. The source bundle lacks CVSS, CWE, complete version range details, and exploitation evidence. Analysis should focus on architecture, Kconfig lineage, fixed stable commits, and downstream vendor backports.
Mitigation direction
Prioritize vendor kernel updates for non-x86 Linux systems and appliances.
Review Linux stable fixes referenced for CVE-2024-35996.
Check Debian and Siemens advisories for product-specific update guidance.
Avoid disabling CPU mitigation options unless formally risk accepted.
Track vendor guidance where exact affected version ranges are unclear.
Validation and detection
Inventory Linux systems by kernel version and CPU architecture.
Identify non-x86 systems using affected kernel build windows.
Confirm deployed kernels include the referenced stable fix commits.
Review kernel configuration for CPU mitigation defaults.
Check vendor appliance advisories for embedded Linux exposure.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-35996 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.