LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35996: cpu: Re-enable CPU mitigations by default for !X86 architectures

In the Linux kernel, the following vulnerability has been resolved: cpu: Re-enable CPU mitigations by default for !X86 architectures Rename x86's to CPU_MITIGATIONS, define it in generic code, and force it on for all architectures exception x86. A recent commit to turn mitigations off by default if SPECULATION_MITIGATIONS=n kinda sorta missed that "cpu_mitigations" is completely generic, whereas SPECULATION_MITIGATIONS is x86-specific. Rename x86's SPECULATIVE_MITIGATIONS instead of keeping both and have it select CPU_MITIGATIONS, as having two configs for the same thing is unnecessary and confusing. This will also allow x86 to use the knob to manage mitigations that aren't strictly related to speculative execution. Use another Kconfig to communicate to common code that CPU_MITIGATIONS is already defined instead of having x86's menu depend on the common CPU_MITIGATIONS. This allows keeping a single point of contact for all of x86's mitigations, and it's not clear that other architectures *want* to allow disabling mitigations at compile-time.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue could leave CPU security mitigations disabled by default on non-x86 systems because a mitigation configuration setting was treated as x86-specific. The business concern is reduced protection on affected Linux hosts or appliances, especially ARM or other non-x86 platforms. The bundle provides no CVSS score and no evidence of active exploitation.

Executive priority

Treat as a medium-priority hardening and platform hygiene issue. It is not presented as actively exploited, but it can silently weaken defenses on non-x86 Linux platforms. Patch through normal kernel and appliance maintenance cycles, with faster handling for internet-facing, multi-tenant, or sensitive workloads.

Technical view

The fix makes CPU_MITIGATIONS generic, forces it on for non-x86 architectures, and has x86 select it through its own mitigation menu. The resolved bug came from a prior change where SPECULATION_MITIGATIONS was x86-specific but cpu_mitigations was generic, causing mitigations to default off outside x86.

Likely exposure

Most relevant exposure is Linux on non-x86 architectures built from vulnerable kernel revisions before the stable fixes. Exact vulnerable version ranges are not fully described in the bundle. Vendor appliances using Linux kernels may also be affected, as reflected by Siemens advisories.

Exploitation context

The bundle does not cite KEV listing, public exploitation, exploit code, or a direct remote attack path. This is a hardening-regression vulnerability: impact depends on architecture, kernel build configuration, and whether CPU mitigation controls were unintentionally disabled.

Researcher notes

Evidence supports a configuration/defaults regression in Linux CPU mitigation handling, not a standalone exploit primitive. The source bundle lacks CVSS, CWE, complete version range details, and exploitation evidence. Analysis should focus on architecture, Kconfig lineage, fixed stable commits, and downstream vendor backports.

Mitigation direction

  • Prioritize vendor kernel updates for non-x86 Linux systems and appliances.
  • Review Linux stable fixes referenced for CVE-2024-35996.
  • Check Debian and Siemens advisories for product-specific update guidance.
  • Avoid disabling CPU mitigation options unless formally risk accepted.
  • Track vendor guidance where exact affected version ranges are unclear.

Validation and detection

  • Inventory Linux systems by kernel version and CPU architecture.
  • Identify non-x86 systems using affected kernel build windows.
  • Confirm deployed kernels include the referenced stable fix commits.
  • Review kernel configuration for CPU mitigation defaults.
  • Check vendor appliance advisories for embedded Linux exposure.
Prepared
Confidence
medium
Sources
9

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-35996 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux30da4180fd768973189dc364648f9c436e57b01d, 70688450dddaf91e12fd4fc625da3297025932c9, 9c09773917fbb77dff85b433e1e89123fc5fb530, 2978ee7c973ce81b6e51100ba1e5ae001af624b9, c4a9babdd5d5a41a74269a2e1aa1647b1b4c45bb, f337a6a21e2fd67eadea471e93d05dd37baaa9beunaffected
LinuxLinux5.15.156, 6.1.87, 6.6.28, 6.8.7unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.