CVE-2024-26690 (GCVE-0-2024-26690)

Vulnerability from cvelistv5 – Published: 2024-04-03 14:54 – Updated: 2026-08-05 11:26
VLAI
Title
net: stmmac: protect updates of 64-bit statistics counters
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: protect updates of 64-bit statistics counters As explained by a comment in <linux/u64_stats_sync.h>, write side of struct u64_stats_sync must ensure mutual exclusion, or one seqcount update could be lost on 32-bit platforms, thus blocking readers forever. Such lockups have been observed in real world after stmmac_xmit() on one CPU raced with stmmac_napi_poll_tx() on another CPU. To fix the issue without introducing a new lock, split the statics into three parts: 1. fields updated only under the tx queue lock, 2. fields updated only during NAPI poll, 3. fields updated only from interrupt context, Updates to fields in the first two groups are already serialized through other locks. It is sufficient to split the existing struct u64_stats_sync so that each group has its own. Note that tx_set_ic_bit is updated from both contexts. Split this counter so that each context gets its own, and calculate their sum to get the total value in stmmac_get_ethtool_stats(). For the third group, multiple interrupts may be processed by different CPUs at the same time, but interrupts on the same CPU will not nest. Move fields from this group to a newly created per-cpu struct stmmac_pcpu_stats.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 133466c3bbe171f826294161db203f7670bb30c8 , < 9680b2ab54ba8d72581100e8c45471306101836e (git)
Affected: 133466c3bbe171f826294161db203f7670bb30c8 , < e6af0f082a4b87b99ad033003be2a904a1791b3f (git)
Affected: 133466c3bbe171f826294161db203f7670bb30c8 , < 38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8 (git)
Affected: ff12183568e0531f6db935378a92237766ad080a (git)
Affected: 6.1.160 , < 6.2 (semver)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.18 , ≤ 6.6.* (semver)
Unaffected: 6.7.6 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-04T15:17:50.464139Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T15:20:28.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.694Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/common.h",
            "drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c",
            "drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c",
            "drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c",
            "drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c",
            "drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c",
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9680b2ab54ba8d72581100e8c45471306101836e",
              "status": "affected",
              "version": "133466c3bbe171f826294161db203f7670bb30c8",
              "versionType": "git"
            },
            {
              "lessThan": "e6af0f082a4b87b99ad033003be2a904a1791b3f",
              "status": "affected",
              "version": "133466c3bbe171f826294161db203f7670bb30c8",
              "versionType": "git"
            },
            {
              "lessThan": "38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8",
              "status": "affected",
              "version": "133466c3bbe171f826294161db203f7670bb30c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ff12183568e0531f6db935378a92237766ad080a",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.160",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/common.h",
            "drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c",
            "drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c",
            "drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c",
            "drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c",
            "drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c",
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.160",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: protect updates of 64-bit statistics counters\n\nAs explained by a comment in \u003clinux/u64_stats_sync.h\u003e, write side of struct\nu64_stats_sync must ensure mutual exclusion, or one seqcount update could\nbe lost on 32-bit platforms, thus blocking readers forever. Such lockups\nhave been observed in real world after stmmac_xmit() on one CPU raced with\nstmmac_napi_poll_tx() on another CPU.\n\nTo fix the issue without introducing a new lock, split the statics into\nthree parts:\n\n1. fields updated only under the tx queue lock,\n2. fields updated only during NAPI poll,\n3. fields updated only from interrupt context,\n\nUpdates to fields in the first two groups are already serialized through\nother locks. It is sufficient to split the existing struct u64_stats_sync\nso that each group has its own.\n\nNote that tx_set_ic_bit is updated from both contexts. Split this counter\nso that each context gets its own, and calculate their sum to get the total\nvalue in stmmac_get_ethtool_stats().\n\nFor the third group, multiple interrupts may be processed by different CPUs\nat the same time, but interrupts on the same CPU will not nest. Move fields\nfrom this group to a newly created per-cpu struct stmmac_pcpu_stats."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Both writers that race (`stmmac_xmit()`/`stmmac_tso_xmit()` and `stmmac_napi_poll_tx()`/`dwmac*_dma_interrupt()`) are driven entirely by packet TX/RX on an Ethernet MAC, so a remote peer flooding the interface with traffic that elicits replies drives the concurrent updates. stmmac interfaces are routinely internet-facing on embedded routers, gateways and industrial edge devices, with no layer-2 adjacency requirement.\nAC:L - The attacker creates both sides of the race by sustaining line-rate traffic, giving millions of race opportunities per second until a seqcount increment is lost, and once lost the corruption is permanent. The 32-bit precondition is satisfied by the mainstream 32-bit ARM SoCs (STM32MP1, Allwinner, Amlogic, Rockchip, i.MX6) where stmmac is the standard MAC.\nPR:N - Sending packets to the target interface requires no authentication or credentials whatsoever, and the vulnerable statistics updates happen unconditionally during normal packet processing. The stats readers that then hang are themselves unprivileged (/proc/net/dev, sysfs statistics, RTM_GETLINK).\nUI:N - No victim action is required \u2014 the seqcount is corrupted purely by attacker-driven traffic, and the resulting hang is triggered by routine stats reads that monitoring daemons, DHCP clients and network tooling perform automatically. A local attacker can also simply read /proc/net/dev themselves.\nS:U - The corrupted seqcount and the resulting spin are both within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU or sandbox boundary. This is a standard in-kernel denial of service.\nC:N - The bug desynchronizes a seqcount protecting driver statistics counters; there is no out-of-bounds read, no use-after-free and no kernel pointer exposure. The only values that can be observed torn are non-sensitive packet/byte counters already legitimately visible to the reader.\nI:N - No memory corruption, out-of-bounds write or control-flow primitive is created \u2014 only the driver\u0027s own statistics counters can be read in an inconsistent state. No attacker-controlled data is written to kernel memory.\nA:H - A permanently odd seqcount makes `read_seqcount_begin()` spin forever, and the spinning readers hold `rcu_read_lock()` (/proc/net/dev), `dev_base_lock` with preemption disabled (sysfs statistics), or `rtnl_lock` (RTM_GETLINK), escalating to RCU stalls, CPU soft/hard lockups and a permanently wedged networking subsystem that requires a reboot. The commit message confirms such lockups were observed in the field."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:43.194Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8"
        }
      ],
      "title": "net: stmmac: protect updates of 64-bit statistics counters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26690",
    "datePublished": "2024-04-03T14:54:51.709Z",
    "dateReserved": "2024-02-19T14:20:24.154Z",
    "dateUpdated": "2026-08-05T11:26:43.194Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26690",
      "date": "2026-08-09",
      "epss": "0.00836",
      "percentile": "0.54298"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: stmmac: protect updates of 64-bit statistics counters\\n\\nAs explained by a comment in \u003clinux/u64_stats_sync.h\u003e, write side of struct\\nu64_stats_sync must ensure mutual exclusion, or one seqcount update could\\nbe lost on 32-bit platforms, thus blocking readers forever. Such lockups\\nhave been observed in real world after stmmac_xmit() on one CPU raced with\\nstmmac_napi_poll_tx() on another CPU.\\n\\nTo fix the issue without introducing a new lock, split the statics into\\nthree parts:\\n\\n1. fields updated only under the tx queue lock,\\n2. fields updated only during NAPI poll,\\n3. fields updated only from interrupt context,\\n\\nUpdates to fields in the first two groups are already serialized through\\nother locks. It is sufficient to split the existing struct u64_stats_sync\\nso that each group has its own.\\n\\nNote that tx_set_ic_bit is updated from both contexts. Split this counter\\nso that each context gets its own, and calculate their sum to get the total\\nvalue in stmmac_get_ethtool_stats().\\n\\nFor the third group, multiple interrupts may be processed by different CPUs\\nat the same time, but interrupts on the same CPU will not nest. Move fields\\nfrom this group to a newly created per-cpu struct stmmac_pcpu_stats.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: stmmac: protege las actualizaciones de los contadores de estad\\u00edsticas de 64 bits. Como se explica en un comentario en , el lado de escritura de la estructura u64_stats_sync debe garantizar la exclusi\\u00f3n mutua, o uno La actualizaci\\u00f3n de seqcount podr\\u00eda perderse en plataformas de 32 bits, bloqueando as\\u00ed a los lectores para siempre. Estos bloqueos se han observado en el mundo real despu\\u00e9s de que stmmac_xmit() en una CPU compitiera con stmmac_napi_poll_tx() en otra CPU. Para solucionar el problema sin introducir un nuevo bloqueo, divida la est\\u00e1tica en tres partes: 1. campos actualizados solo bajo el bloqueo de la cola de transmisi\\u00f3n, 2. campos actualizados solo durante la encuesta NAPI, 3. campos actualizados solo desde el contexto de interrupci\\u00f3n, Actualizaciones de los campos en los dos primeros grupos ya est\\u00e1n serializados a trav\\u00e9s de otras cerraduras. Basta con dividir la estructura existente u64_stats_sync para que cada grupo tenga el suyo propio. Tenga en cuenta que tx_set_ic_bit se actualiza desde ambos contextos. Divida este contador para que cada contexto tenga el suyo y calcule su suma para obtener el valor total en stmmac_get_ethtool_stats(). Para el tercer grupo, diferentes CPU pueden procesar m\\u00faltiples interrupciones al mismo tiempo, pero las interrupciones en la misma CPU no se anidar\\u00e1n. Mueva los campos de este grupo a una estructura por CPU stmmac_pcpu_stats reci\\u00e9n creada.\"}]",
      "id": "CVE-2024-26690",
      "lastModified": "2024-11-21T09:02:51.193",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2024-04-03T15:15:52.487",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26690\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T15:15:52.487\",\"lastModified\":\"2026-08-04T11:16:56.417\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: stmmac: protect updates of 64-bit statistics counters\\n\\nAs explained by a comment in \u003clinux/u64_stats_sync.h\u003e, write side of struct\\nu64_stats_sync must ensure mutual exclusion, or one seqcount update could\\nbe lost on 32-bit platforms, thus blocking readers forever. Such lockups\\nhave been observed in real world after stmmac_xmit() on one CPU raced with\\nstmmac_napi_poll_tx() on another CPU.\\n\\nTo fix the issue without introducing a new lock, split the statics into\\nthree parts:\\n\\n1. fields updated only under the tx queue lock,\\n2. fields updated only during NAPI poll,\\n3. fields updated only from interrupt context,\\n\\nUpdates to fields in the first two groups are already serialized through\\nother locks. It is sufficient to split the existing struct u64_stats_sync\\nso that each group has its own.\\n\\nNote that tx_set_ic_bit is updated from both contexts. Split this counter\\nso that each context gets its own, and calculate their sum to get the total\\nvalue in stmmac_get_ethtool_stats().\\n\\nFor the third group, multiple interrupts may be processed by different CPUs\\nat the same time, but interrupts on the same CPU will not nest. Move fields\\nfrom this group to a newly created per-cpu struct stmmac_pcpu_stats.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: stmmac: protege las actualizaciones de los contadores de estad\u00edsticas de 64 bits. Como se explica en un comentario en , el lado de escritura de la estructura u64_stats_sync debe garantizar la exclusi\u00f3n mutua, o uno La actualizaci\u00f3n de seqcount podr\u00eda perderse en plataformas de 32 bits, bloqueando as\u00ed a los lectores para siempre. Estos bloqueos se han observado en el mundo real despu\u00e9s de que stmmac_xmit() en una CPU compitiera con stmmac_napi_poll_tx() en otra CPU. Para solucionar el problema sin introducir un nuevo bloqueo, divida la est\u00e1tica en tres partes: 1. campos actualizados solo bajo el bloqueo de la cola de transmisi\u00f3n, 2. campos actualizados solo durante la encuesta NAPI, 3. campos actualizados solo desde el contexto de interrupci\u00f3n, Actualizaciones de los campos en los dos primeros grupos ya est\u00e1n serializados a trav\u00e9s de otras cerraduras. Basta con dividir la estructura existente u64_stats_sync para que cada grupo tenga el suyo propio. Tenga en cuenta que tx_set_ic_bit se actualiza desde ambos contextos. Divida este contador para que cada contexto tenga el suyo y calcule su suma para obtener el valor total en stmmac_get_ethtool_stats(). Para el tercer grupo, diferentes CPU pueden procesar m\u00faltiples interrupciones al mismo tiempo, pero las interrupciones en la misma CPU no se anidar\u00e1n. Mueva los campos de este grupo a una estructura por CPU stmmac_pcpu_stats reci\u00e9n creada.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/common.h\",\"drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c\",\"drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c\",\"drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c\",\"drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c\",\"drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c\",\"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"133466c3bbe171f826294161db203f7670bb30c8\",\"lessThan\":\"9680b2ab54ba8d72581100e8c45471306101836e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"133466c3bbe171f826294161db203f7670bb30c8\",\"lessThan\":\"e6af0f082a4b87b99ad033003be2a904a1791b3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"133466c3bbe171f826294161db203f7670bb30c8\",\"lessThan\":\"38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff12183568e0531f6db935378a92237766ad080a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.160\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/common.h\",\"drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c\",\"drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c\",\"drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c\",\"drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c\",\"drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c\",\"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.18\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.6\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-04T15:17:50.464139Z\",\"id\":\"CVE-2024-26690\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.18\",\"matchCriteriaId\":\"8ED485BB-BF8B-4D25-809B-B538663EA8D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.6\",\"matchCriteriaId\":\"C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F02056A5-B362-4370-9FF8-6F0BD384D520\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:51:11+00:00",
      "cve": "CVE-2024-26690",
      "id": "CVE-2024-26690",
      "initial_release_date": "2024-04-03T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: stmmac: protect updates of 64-bit statistics counters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26690.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:56:58Z",
      "cve": "CVE-2024-26690",
      "id": "CVE-2024-26690",
      "initial_release_date": "2024-04-09T02:29:13Z",
      "product_status:known_not_affected": "272",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26690",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26690.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:12.694Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26690\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-04T15:17:50.464139Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.976Z\"}}], \"cna\": {\"title\": \"net: stmmac: protect updates of 64-bit statistics counters\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - Both writers that race (`stmmac_xmit()`/`stmmac_tso_xmit()` and `stmmac_napi_poll_tx()`/`dwmac*_dma_interrupt()`) are driven entirely by packet TX/RX on an Ethernet MAC, so a remote peer flooding the interface with traffic that elicits replies drives the concurrent updates. stmmac interfaces are routinely internet-facing on embedded routers, gateways and industrial edge devices, with no layer-2 adjacency requirement.\\nAC:L - The attacker creates both sides of the race by sustaining line-rate traffic, giving millions of race opportunities per second until a seqcount increment is lost, and once lost the corruption is permanent. The 32-bit precondition is satisfied by the mainstream 32-bit ARM SoCs (STM32MP1, Allwinner, Amlogic, Rockchip, i.MX6) where stmmac is the standard MAC.\\nPR:N - Sending packets to the target interface requires no authentication or credentials whatsoever, and the vulnerable statistics updates happen unconditionally during normal packet processing. The stats readers that then hang are themselves unprivileged (/proc/net/dev, sysfs statistics, RTM_GETLINK).\\nUI:N - No victim action is required \\u2014 the seqcount is corrupted purely by attacker-driven traffic, and the resulting hang is triggered by routine stats reads that monitoring daemons, DHCP clients and network tooling perform automatically. A local attacker can also simply read /proc/net/dev themselves.\\nS:U - The corrupted seqcount and the resulting spin are both within the kernel\u0027s own security authority, with no crossing of a VM, IOMMU or sandbox boundary. This is a standard in-kernel denial of service.\\nC:N - The bug desynchronizes a seqcount protecting driver statistics counters; there is no out-of-bounds read, no use-after-free and no kernel pointer exposure. The only values that can be observed torn are non-sensitive packet/byte counters already legitimately visible to the reader.\\nI:N - No memory corruption, out-of-bounds write or control-flow primitive is created \\u2014 only the driver\u0027s own statistics counters can be read in an inconsistent state. No attacker-controlled data is written to kernel memory.\\nA:H - A permanently odd seqcount makes `read_seqcount_begin()` spin forever, and the spinning readers hold `rcu_read_lock()` (/proc/net/dev), `dev_base_lock` with preemption disabled (sysfs statistics), or `rtnl_lock` (RTM_GETLINK), escalating to RCU stalls, CPU soft/hard lockups and a permanently wedged networking subsystem that requires a reboot. The commit message confirms such lockups were observed in the field.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"133466c3bbe171f826294161db203f7670bb30c8\", \"lessThan\": \"9680b2ab54ba8d72581100e8c45471306101836e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"133466c3bbe171f826294161db203f7670bb30c8\", \"lessThan\": \"e6af0f082a4b87b99ad033003be2a904a1791b3f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"133466c3bbe171f826294161db203f7670bb30c8\", \"lessThan\": \"38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ff12183568e0531f6db935378a92237766ad080a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.1.160\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/stmicro/stmmac/common.h\", \"drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c\", \"drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c\", \"drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c\", \"drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c\", \"drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c\", \"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/stmicro/stmmac/common.h\", \"drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c\", \"drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c\", \"drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c\", \"drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c\", \"drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c\", \"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e\"}, {\"url\": \"https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f\"}, {\"url\": \"https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: stmmac: protect updates of 64-bit statistics counters\\n\\nAs explained by a comment in \u003clinux/u64_stats_sync.h\u003e, write side of struct\\nu64_stats_sync must ensure mutual exclusion, or one seqcount update could\\nbe lost on 32-bit platforms, thus blocking readers forever. Such lockups\\nhave been observed in real world after stmmac_xmit() on one CPU raced with\\nstmmac_napi_poll_tx() on another CPU.\\n\\nTo fix the issue without introducing a new lock, split the statics into\\nthree parts:\\n\\n1. fields updated only under the tx queue lock,\\n2. fields updated only during NAPI poll,\\n3. fields updated only from interrupt context,\\n\\nUpdates to fields in the first two groups are already serialized through\\nother locks. It is sufficient to split the existing struct u64_stats_sync\\nso that each group has its own.\\n\\nNote that tx_set_ic_bit is updated from both contexts. Split this counter\\nso that each context gets its own, and calculate their sum to get the total\\nvalue in stmmac_get_ethtool_stats().\\n\\nFor the third group, multiple interrupts may be processed by different CPUs\\nat the same time, but interrupts on the same CPU will not nest. Move fields\\nfrom this group to a newly created per-cpu struct stmmac_pcpu_stats.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.18\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.6\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.1.160\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:26:43.194Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26690\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:26:43.194Z\", \"dateReserved\": \"2024-02-19T14:20:24.154Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T14:54:51.709Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.