CVE-2024-26787

What it actually does

Unbalanced dma_map_sg and dma_unmap_sg calls in the STM32 variant of the mmci driver allow overlapping DMA mappings when errors occur in mmci_cmd_irq, because mmci_dma_error does not perform unmapping on this platform.

Why it matters to the business

Systems using affected STM32-based MMC controllers may experience kernel warnings, resource leaks, or crashes during storage initialization and tuning operations, increasing operational risk for embedded Linux deployments.

How an attack unfolds

A local process or kernel worker triggers MMC rescan and tuning sequences; an error path in command handling skips the required unmap, leaving mappings active and causing debug or stability issues on subsequent operations.

How to fix it

Update the Linux kernel to commit 0224cbc53ba82b84affa7619b6d1b1a254bc2c53 or later stable releases containing the fix for the STM32 mmci DMA error path.

How to confirm the fix worked

Boot with CONFIG_DMA_API_DEBUG_SG enabled and confirm absence of overlapping mapping warnings during mmc_rescan and tuning; verify the fixed commit is present in the running kernel.

Typical attack path

1. Trigger mmc_rescan or card attach via local process or hardware event
2. Enter mmci_request path leading to sdmmc_execute_tuning
3. Encounter error in mmci_cmd_irq without calling balanced dma_unmap_sg
4. Observe DMA API debug warning or subsequent mapping failures

How to detect it

Search kernel logs for DMA-API overlapping mappings warnings referencing mmci-pl18x and mmc_rescan; examine call traces involving sdmmc_idma_prep_data and mmci_cmd_irq error paths.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on STM32 platforms
• Monitor kernel logs for DMA API warnings on affected hardware
• Prioritize patching in environments where CONFIG_DMA_API_DEBUG_SG or similar debugging is active