CVE-2024-26690

What it actually does

Race condition in stmmac driver where concurrent updates to 64-bit u64_stats_sync counters from stmmac_xmit() and stmmac_napi_poll_tx() on different CPUs can lose a seqcount update on 32-bit platforms, permanently blocking readers and causing lockups.

Why it matters to the business

Networking stack on 32-bit Linux systems can hang under normal traffic loads, leading to packet loss, interface instability, or system unresponsiveness until reboot; affects many embedded and older server deployments using stmmac Ethernet.

How an attack unfolds

An attacker sends or triggers network traffic that causes stmmac_xmit on one CPU to race with NAPI TX polling on another CPU; the lost seqcount leaves statistics readers spinning forever, manifesting as a denial of service without requiring special privileges beyond normal network access.

How to fix it

Upgrade the Linux kernel to a version containing commit 9680b2ab54ba8d72581100e8c45471306101836e which splits the statistics structures by update context (TX queue lock, NAPI, interrupt) and uses per-CPU storage for interrupt-context counters.

How to confirm the fix worked

Confirm the running kernel Git commit or version includes 9680b2ab54ba8d72581100e8c45471306101836e; inspect /proc/net/dev or ethtool statistics under load on 32-bit systems to verify no reader lockups occur.

Typical attack path

1. Establish network connectivity to a vulnerable stmmac interface
2. Generate concurrent TX traffic and NAPI polling events across CPUs
3. Trigger the u64_stats_sync race on 32-bit kernel
4. Cause permanent reader blockage and networking degradation

How to detect it

Review kernel logs for repeated stmmac statistics access stalls or hung NAPI poll threads; correlate with high TX queue activity on multi-CPU 32-bit systems; no specific post-exploitation artifacts are produced.

What your security team should do

• Prioritize kernel upgrade on all 32-bit systems using stmmac drivers
• Apply the fixed commit or backport the per-context statistics split
• Monitor for interface hangs under multi-CPU TX load until patched
• Test upgraded kernels in staging environments before broad rollout