{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26690","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.154Z","datePublished":"2024-04-03T14:54:51.709Z","dateUpdated":"2026-08-05T11:26:43.194Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:26:43.194Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: protect updates of 64-bit statistics counters\n\nAs explained by a comment in <linux/u64_stats_sync.h>, write side of struct\nu64_stats_sync must ensure mutual exclusion, or one seqcount update could\nbe lost on 32-bit platforms, thus blocking readers forever. Such lockups\nhave been observed in real world after stmmac_xmit() on one CPU raced with\nstmmac_napi_poll_tx() on another CPU.\n\nTo fix the issue without introducing a new lock, split the statics into\nthree parts:\n\n1. fields updated only under the tx queue lock,\n2. fields updated only during NAPI poll,\n3. fields updated only from interrupt context,\n\nUpdates to fields in the first two groups are already serialized through\nother locks. It is sufficient to split the existing struct u64_stats_sync\nso that each group has its own.\n\nNote that tx_set_ic_bit is updated from both contexts. Split this counter\nso that each context gets its own, and calculate their sum to get the total\nvalue in stmmac_get_ethtool_stats().\n\nFor the third group, multiple interrupts may be processed by different CPUs\nat the same time, but interrupts on the same CPU will not nest. Move fields\nfrom this group to a newly created per-cpu struct stmmac_pcpu_stats."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - Both writers that race (`stmmac_xmit()`/`stmmac_tso_xmit()` and `stmmac_napi_poll_tx()`/`dwmac*_dma_interrupt()`) are driven entirely by packet TX/RX on an Ethernet MAC, so a remote peer flooding the interface with traffic that elicits replies drives the concurrent updates. stmmac interfaces are routinely internet-facing on embedded routers, gateways and industrial edge devices, with no layer-2 adjacency requirement.\nAC:L - The attacker creates both sides of the race by sustaining line-rate traffic, giving millions of race opportunities per second until a seqcount increment is lost, and once lost the corruption is permanent. The 32-bit precondition is satisfied by the mainstream 32-bit ARM SoCs (STM32MP1, Allwinner, Amlogic, Rockchip, i.MX6) where stmmac is the standard MAC.\nPR:N - Sending packets to the target interface requires no authentication or credentials whatsoever, and the vulnerable statistics updates happen unconditionally during normal packet processing. The stats readers that then hang are themselves unprivileged (/proc/net/dev, sysfs statistics, RTM_GETLINK).\nUI:N - No victim action is required — the seqcount is corrupted purely by attacker-driven traffic, and the resulting hang is triggered by routine stats reads that monitoring daemons, DHCP clients and network tooling perform automatically. A local attacker can also simply read /proc/net/dev themselves.\nS:U - The corrupted seqcount and the resulting spin are both within the kernel's own security authority, with no crossing of a VM, IOMMU or sandbox boundary. This is a standard in-kernel denial of service.\nC:N - The bug desynchronizes a seqcount protecting driver statistics counters; there is no out-of-bounds read, no use-after-free and no kernel pointer exposure. The only values that can be observed torn are non-sensitive packet/byte counters already legitimately visible to the reader.\nI:N - No memory corruption, out-of-bounds write or control-flow primitive is created — only the driver's own statistics counters can be read in an inconsistent state. No attacker-controlled data is written to kernel memory.\nA:H - A permanently odd seqcount makes `read_seqcount_begin()` spin forever, and the spinning readers hold `rcu_read_lock()` (/proc/net/dev), `dev_base_lock` with preemption disabled (sysfs statistics), or `rtnl_lock` (RTM_GETLINK), escalating to RCU stalls, CPU soft/hard lockups and a permanently wedged networking subsystem that requires a reboot. The commit message confirms such lockups were observed in the field."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/stmicro/stmmac/common.h","drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c","drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c","drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c","drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c","drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c","drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"],"versions":[{"version":"133466c3bbe171f826294161db203f7670bb30c8","lessThan":"9680b2ab54ba8d72581100e8c45471306101836e","status":"affected","versionType":"git"},{"version":"133466c3bbe171f826294161db203f7670bb30c8","lessThan":"e6af0f082a4b87b99ad033003be2a904a1791b3f","status":"affected","versionType":"git"},{"version":"133466c3bbe171f826294161db203f7670bb30c8","lessThan":"38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8","status":"affected","versionType":"git"},{"version":"ff12183568e0531f6db935378a92237766ad080a","status":"affected","versionType":"git"},{"version":"6.1.160","lessThan":"6.2","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/stmicro/stmmac/common.h","drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c","drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c","drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c","drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c","drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c","drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.18","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.6","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.7.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.160"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e"},{"url":"https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f"},{"url":"https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8"}],"title":"net: stmmac: protect updates of 64-bit statistics counters","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-04-04T15:17:50.464139Z","id":"CVE-2024-26690","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-11-06T15:20:28.318Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:14:12.694Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8","tags":["x_transferred"]}]}]}}