CVE-2024-53137: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-53137 affects the Linux kernel's cacheflush syscall implementation on ARM architectures. The vulnerability was discovered when the cacheflush syscall became broken after the implementation of PAN (Privileged Access Never) for LPAE (Large Physical Address Extension). The issue was introduced by the commit that implemented PAN for LPAE through TTBR0 page table walks disablement (Kernel Git).

The vulnerability stems from a failure to enable user access around cache maintenance instructions in the ARM implementation, causing these instructions to fault. The issue has a CVSS v3.1 Base Score of 5.5 (Medium) with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access requirements and potential high impact on availability (NVD).

The vulnerability affects system availability by causing cache maintenance instructions to fault, potentially disrupting normal system operations on affected ARM-based Linux systems. This impacts Linux kernel versions from 6.10 up to 6.11.10, as well as various release candidates of version 6.12 (NVD).

A fix has been implemented and committed to the Linux kernel. The patch adds proper user access management around cache maintenance instructions by implementing uaccess_save_and_enable() and uaccess_restore() calls in the affected code section (Kernel Git).