CVE-2024-26690

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26690", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.154Z", "datePublished": "2024-04-03T14:54:51.709Z", "dateUpdated": "2026-10-30T12:17:48.897Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:17:48.897Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: protect updates of 64-bit statistics counters\n\nAs explained by a comment in <linux/u64_stats_sync.h>, write side of struct\nu64_stats_sync must ensure mutual exclusion, or one seqcount update could\nbe lost on 32-bit platforms, thus blocking readers forever. Such lockups\nhave been observed in real world after stmmac_xmit() on one CPU raced with\nstmmac_napi_poll_tx() on another CPU.\n\nTo fix the issue without introducing a new lock, split the statics into\nthree parts:\n\n1. fields updated only under the tx queue lock,\n2. fields updated only during NAPI poll,\n3. fields updated only from interrupt context,\n\nUpdates to fields in the first two groups are already serialized through\nother locks. It is sufficient to split the existing struct u64_stats_sync\nso that each group has its own.\n\nNote that tx_set_ic_bit is updated from both contexts. Split this counter\nso that each context gets its own, and calculate their sum to get the total\nvalue in stmmac_get_ethtool_stats().\n\nFor the third group, multiple interrupts may be processed by different CPUs\nat the same time, but interrupts on the same CPU will not nest. Move fields\nfrom this group to a newly created per-cpu struct stmmac_pcpu_stats."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - Both writers that race (`stmmac_xmit()`/`stmmac_tso_xmit()` and `stmmac_napi_poll_tx()`/`dwmac*_dma_interrupt()`) are driven entirely by packet TX/RX on an Ethernet MAC, so a remote peer flooding the interface with traffic that elicits replies drives the concurrent updates. stmmac interfaces are routinely internet-facing on embedded routers, gateways and industrial edge devices, with no layer-2 adjacency requirement.\nAC:L - The attacker creates both sides of the race by sustaining line-rate traffic, giving millions of race opportunities per second until a seqcount increment is lost, and once lost the corruption is permanent. The 32-bit precondition is satisfied by the mainstream 32-bit ARM SoCs (STM32MP1, Allwinner, Amlogic, Rockchip, i.MX6) where stmmac is the standard MAC.\nPR:N - Sending packets to the target interface requires no authentication or credentials whatsoever, and the vulnerable statistics updates happen unconditionally during normal packet processing. The stats readers that then hang are themselves unprivileged (/proc/net/dev, sysfs statistics, RTM_GETLINK).\nUI:N - No victim action is required \u2014 the seqcount is corrupted purely by attacker-driven traffic, and the resulting hang is triggered by routine stats reads that monitoring daemons, DHCP clients and network tooling perform automatically. A local attacker can also simply read /proc/net/dev themselves.\nS:U - The corrupted seqcount and the resulting spin are both within the kernel's own security authority, with no crossing of a VM, IOMMU or sandbox boundary. This is a standard in-kernel denial of service.\nC:N - The bug desynchronizes a seqcount protecting driver statistics counters; there is no out-of-bounds read, no use-after-free and no kernel pointer exposure. The only values that can be observed torn are non-sensitive packet/byte counters already legitimately visible to the reader.\nI:N - No memory corruption, out-of-bounds write or control-flow primitive is created \u2014 only the driver's own statistics counters can be read in an inconsistent state. No attacker-controlled data is written to kernel memory.\nA:H - A permanently odd seqcount makes `read_seqcount_begin()` spin forever, and the spinning readers hold `rcu_read_lock()` (/proc/net/dev), `dev_base_lock` with preemption disabled (sysfs statistics), or `rtnl_lock` (RTM_GETLINK), escalating to RCU stalls, CPU soft/hard lockups and a permanently wedged networking subsystem that requires a reboot. The commit message confirms such lockups were observed in the field."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/common.h", "drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c", "drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "versions": [{"version": "ff12183568e0531f6db935378a92237766ad080a", "lessThan": "52002cae02db6ab4c50efe4095d68db3a6892b11", "status": "affected", "versionType": "git"}, {"version": "133466c3bbe171f826294161db203f7670bb30c8", "lessThan": "9680b2ab54ba8d72581100e8c45471306101836e", "status": "affected", "versionType": "git"}, {"version": "133466c3bbe171f826294161db203f7670bb30c8", "lessThan": "e6af0f082a4b87b99ad033003be2a904a1791b3f", "status": "affected", "versionType": "git"}, {"version": "133466c3bbe171f826294161db203f7670bb30c8", "lessThan": "38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8", "status": "affected", "versionType": "git"}, {"version": "6.1.160", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/common.h", "drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c", "drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.18", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.6", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.160", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.7.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/52002cae02db6ab4c50efe4095d68db3a6892b11"}, {"url": "https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e"}, {"url": "https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f"}, {"url": "https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8"}], "title": "net: stmmac: protect updates of 64-bit statistics counters", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-04-04T15:17:50.464139Z", "id": "CVE-2024-26690", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-06T15:20:28.318Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.694Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:12.694Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-26690", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-04T15:17:50.464139Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:21.976Z"}}], "cna": {"title": "net: stmmac: protect updates of 64-bit statistics counters", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - Both writers that race (`stmmac_xmit()`/`stmmac_tso_xmit()` and `stmmac_napi_poll_tx()`/`dwmac*_dma_interrupt()`) are driven entirely by packet TX/RX on an Ethernet MAC, so a remote peer flooding the interface with traffic that elicits replies drives the concurrent updates. stmmac interfaces are routinely internet-facing on embedded routers, gateways and industrial edge devices, with no layer-2 adjacency requirement.\nAC:L - The attacker creates both sides of the race by sustaining line-rate traffic, giving millions of race opportunities per second until a seqcount increment is lost, and once lost the corruption is permanent. The 32-bit precondition is satisfied by the mainstream 32-bit ARM SoCs (STM32MP1, Allwinner, Amlogic, Rockchip, i.MX6) where stmmac is the standard MAC.\nPR:N - Sending packets to the target interface requires no authentication or credentials whatsoever, and the vulnerable statistics updates happen unconditionally during normal packet processing. The stats readers that then hang are themselves unprivileged (/proc/net/dev, sysfs statistics, RTM_GETLINK).\nUI:N - No victim action is required \u2014 the seqcount is corrupted purely by attacker-driven traffic, and the resulting hang is triggered by routine stats reads that monitoring daemons, DHCP clients and network tooling perform automatically. A local attacker can also simply read /proc/net/dev themselves.\nS:U - The corrupted seqcount and the resulting spin are both within the kernel's own security authority, with no crossing of a VM, IOMMU or sandbox boundary. This is a standard in-kernel denial of service.\nC:N - The bug desynchronizes a seqcount protecting driver statistics counters; there is no out-of-bounds read, no use-after-free and no kernel pointer exposure. The only values that can be observed torn are non-sensitive packet/byte counters already legitimately visible to the reader.\nI:N - No memory corruption, out-of-bounds write or control-flow primitive is created \u2014 only the driver's own statistics counters can be read in an inconsistent state. No attacker-controlled data is written to kernel memory.\nA:H - A permanently odd seqcount makes `read_seqcount_begin()` spin forever, and the spinning readers hold `rcu_read_lock()` (/proc/net/dev), `dev_base_lock` with preemption disabled (sysfs statistics), or `rtnl_lock` (RTM_GETLINK), escalating to RCU stalls, CPU soft/hard lockups and a permanently wedged networking subsystem that requires a reboot. The commit message confirms such lockups were observed in the field."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ff12183568e0531f6db935378a92237766ad080a", "lessThan": "52002cae02db6ab4c50efe4095d68db3a6892b11", "versionType": "git"}, {"status": "affected", "version": "133466c3bbe171f826294161db203f7670bb30c8", "lessThan": "9680b2ab54ba8d72581100e8c45471306101836e", "versionType": "git"}, {"status": "affected", "version": "133466c3bbe171f826294161db203f7670bb30c8", "lessThan": "e6af0f082a4b87b99ad033003be2a904a1791b3f", "versionType": "git"}, {"status": "affected", "version": "133466c3bbe171f826294161db203f7670bb30c8", "lessThan": "38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8", "versionType": "git"}, {"status": "affected", "version": "6.1.160", "lessThan": "6.1.191", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/stmicro/stmmac/common.h", "drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c", "drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"status": "unaffected", "version": "0", "lessThan": "6.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.18", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.6", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/stmicro/stmmac/common.h", "drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c", "drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/52002cae02db6ab4c50efe4095d68db3a6892b11"}, {"url": "https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e"}, {"url": "https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f"}, {"url": "https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: protect updates of 64-bit statistics counters\n\nAs explained by a comment in <linux/u64_stats_sync.h>, write side of struct\nu64_stats_sync must ensure mutual exclusion, or one seqcount update could\nbe lost on 32-bit platforms, thus blocking readers forever. Such lockups\nhave been observed in real world after stmmac_xmit() on one CPU raced with\nstmmac_napi_poll_tx() on another CPU.\n\nTo fix the issue without introducing a new lock, split the statics into\nthree parts:\n\n1. fields updated only under the tx queue lock,\n2. fields updated only during NAPI poll,\n3. fields updated only from interrupt context,\n\nUpdates to fields in the first two groups are already serialized through\nother locks. It is sufficient to split the existing struct u64_stats_sync\nso that each group has its own.\n\nNote that tx_set_ic_bit is updated from both contexts. Split this counter\nso that each context gets its own, and calculate their sum to get the total\nvalue in stmmac_get_ethtool_stats().\n\nFor the third group, multiple interrupts may be processed by different CPUs\nat the same time, but interrupts on the same CPU will not nest. Move fields\nfrom this group to a newly created per-cpu struct stmmac_pcpu_stats."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "6.1.160"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.18", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.6", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:17:48.897Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26690", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:17:48.897Z", "dateReserved": "2024-02-19T14:20:24.154Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-03T14:54:51.709Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/common.h", "drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c", "drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "52002cae02db6ab4c50efe4095d68db3a6892b11", "status": "affected", "version": "ff12183568e0531f6db935378a92237766ad080a", "versionType": "git"}, {"lessThan": "9680b2ab54ba8d72581100e8c45471306101836e", "status": "affected", "version": "133466c3bbe171f826294161db203f7670bb30c8", "versionType": "git"}, {"lessThan": "e6af0f082a4b87b99ad033003be2a904a1791b3f", "status": "affected", "version": "133466c3bbe171f826294161db203f7670bb30c8", "versionType": "git"}, {"lessThan": "38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8", "status": "affected", "version": "133466c3bbe171f826294161db203f7670bb30c8", "versionType": "git"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.160", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/common.h", "drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c", "drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c", "drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c", "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.18", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8ED485BB-BF8B-4D25-809B-B538663EA8D7", "versionEndExcluding": "6.6.18", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82", "versionEndExcluding": "6.7.6", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: protect updates of 64-bit statistics counters\n\nAs explained by a comment in <linux/u64_stats_sync.h>, write side of struct\nu64_stats_sync must ensure mutual exclusion, or one seqcount update could\nbe lost on 32-bit platforms, thus blocking readers forever. Such lockups\nhave been observed in real world after stmmac_xmit() on one CPU raced with\nstmmac_napi_poll_tx() on another CPU.\n\nTo fix the issue without introducing a new lock, split the statics into\nthree parts:\n\n1. fields updated only under the tx queue lock,\n2. fields updated only during NAPI poll,\n3. fields updated only from interrupt context,\n\nUpdates to fields in the first two groups are already serialized through\nother locks. It is sufficient to split the existing struct u64_stats_sync\nso that each group has its own.\n\nNote that tx_set_ic_bit is updated from both contexts. Split this counter\nso that each context gets its own, and calculate their sum to get the total\nvalue in stmmac_get_ethtool_stats().\n\nFor the third group, multiple interrupts may be processed by different CPUs\nat the same time, but interrupts on the same CPU will not nest. Move fields\nfrom this group to a newly created per-cpu struct stmmac_pcpu_stats."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: stmmac: protege las actualizaciones de los contadores de estad\u00edsticas de 64 bits. Como se explica en un comentario en , el lado de escritura de la estructura u64_stats_sync debe garantizar la exclusi\u00f3n mutua, o uno La actualizaci\u00f3n de seqcount podr\u00eda perderse en plataformas de 32 bits, bloqueando as\u00ed a los lectores para siempre. Estos bloqueos se han observado en el mundo real despu\u00e9s de que stmmac_xmit() en una CPU compitiera con stmmac_napi_poll_tx() en otra CPU. Para solucionar el problema sin introducir un nuevo bloqueo, divida la est\u00e1tica en tres partes: 1. campos actualizados solo bajo el bloqueo de la cola de transmisi\u00f3n, 2. campos actualizados solo durante la encuesta NAPI, 3. campos actualizados solo desde el contexto de interrupci\u00f3n, Actualizaciones de los campos en los dos primeros grupos ya est\u00e1n serializados a trav\u00e9s de otras cerraduras. Basta con dividir la estructura existente u64_stats_sync para que cada grupo tenga el suyo propio. Tenga en cuenta que tx_set_ic_bit se actualiza desde ambos contextos. Divida este contador para que cada contexto tenga el suyo y calcule su suma para obtener el valor total en stmmac_get_ethtool_stats(). Para el tercer grupo, diferentes CPU pueden procesar m\u00faltiples interrupciones al mismo tiempo, pero las interrupciones en la misma CPU no se anidar\u00e1n. Mueva los campos de este grupo a una estructura por CPU stmmac_pcpu_stats reci\u00e9n creada."}], "id": "CVE-2024-26690", "lastModified": "2026-10-30T13:17:21.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26690", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-04-04T15:17:50.464139Z", "version": "2.0.3"}}]}, "published": "2024-04-03T15:15:52.487", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/52002cae02db6ab4c50efe4095d68db3a6892b11"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: stmmac: protect updates of 64-bit statistics counters", "id": "2273100", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273100"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: stmmac: protect updates of 64-bit statistics counters\nAs explained by a comment in <linux/u64_stats_sync.h>, write side of struct\nu64_stats_sync must ensure mutual exclusion, or one seqcount update could\nbe lost on 32-bit platforms, thus blocking readers forever. Such lockups\nhave been observed in real world after stmmac_xmit() on one CPU raced with\nstmmac_napi_poll_tx() on another CPU.\nTo fix the issue without introducing a new lock, split the statics into\nthree parts:\n1. fields updated only under the tx queue lock,\n2. fields updated only during NAPI poll,\n3. fields updated only from interrupt context,\nUpdates to fields in the first two groups are already serialized through\nother locks. It is sufficient to split the existing struct u64_stats_sync\nso that each group has its own.\nNote that tx_set_ic_bit is updated from both contexts. Split this counter\nso that each context gets its own, and calculate their sum to get the total\nvalue in stmmac_get_ethtool_stats().\nFor the third group, multiple interrupts may be processed by different CPUs\nat the same time, but interrupts on the same CPU will not nest. Move fields\nfrom this group to a newly created per-cpu struct stmmac_pcpu_stats."], "name": "CVE-2024-26690", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26690\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26690\nhttps://lore.kernel.org/linux-cve-announce/2024040336-CVE-2024-26690-0097@gregkh/T"], "threat_severity": "Low"}

{}