CVE-2024-26680

What it actually does

Mismatch between DMA allocation size (extra AQ_CFG_RXDS_DEF bytes) in aq_ring_hwts_rx_alloc() and deallocation in generic aq_ring_free() for the PTP HWTS ring in the atlantic driver, triggering DMA-API size mismatch warnings and potential memory handling issues.

Why it matters to the business

May cause kernel warnings, instability, or crashes during PTP ring allocation/free operations on affected network hardware, increasing operational risk for systems relying on the atlantic driver.

How an attack unfolds

An attacker with local access triggers repeated allocation and freeing of the PTP HWTS ring through network initialization or PTP configuration paths, exposing the size mismatch in DMA operations; no widespread remote exploitation observed despite generic threat actor mentions.

How to fix it

Update the Linux kernel or affected packages to versions containing the fix that introduces a dedicated HWTS ring free function; for xen on Alpine v3.10 apply 4.12.3-r4 or later.

How to confirm the fix worked

Confirm updated driver code includes aq_ring_hwts_rx_free() or equivalent; verify absence of DMA-API warnings on ring free during PTP operations; test with debug_dma enabled.

Typical attack path

1. Gain local access to trigger network device initialization or PTP features
2. Invoke aq_ptp_ring_alloc() which calls aq_ring_hwts_rx_alloc() to map oversized DMA region
3. Trigger aq_ptp_ring_free() leading to aq_ring_free() with mismatched unmap size
4. Observe DMA debug warnings or potential corruption during unmap

How to detect it

Search kernel logs for DMA-API warnings mentioning atlantic, device address mismatches, or check_unmap during aq_ring_free or aq_ptp_ring_free calls; review dmesg for allocation traces from aq_ring_hwts_rx_alloc.

What your security team should do

• Apply the fixed kernel or xen package version immediately on affected systems
• Monitor kernel logs for DMA unmap size warnings related to atlantic
• Restrict PTP features if unnecessary until patched
• Prioritize patching systems with atlantic NICs handling time-sensitive traffic