CVE-2024-49977

What it actually does

Allows port_transmit_rate_kbps to reach zero which is then passed directly to div_s64 when tc-cbs offload is disabled in the stmmac driver, triggering a kernel divide-by-zero fault.

Why it matters to the business

Can crash Linux systems that use the affected stmmac Ethernet controller when network traffic shaping is turned off, leading to unplanned downtime on servers, embedded devices, or appliances.

How an attack unfolds

An attacker with local access enables tc-cbs offload, sets a zero transmit rate, then disables the feature; the kernel path executes div_s64 without a guard, causing an immediate crash. No remote or unauthenticated path exists.

How to fix it

Update the Linux kernel to commit 0c3836482481200ead7b416ca80c68a29cfdaabd or later. Rebuild and reboot with the patched stmmac driver. Until the update is applied, avoid disabling tc-cbs on stmmac interfaces or ensure port_transmit_rate_kbps remains non-zero.

How to confirm the fix worked

Confirm the running kernel contains commit 0c3836482481200ead7b416ca80c68a29cfdaabd; attempt to disable tc-cbs on an stmmac interface while monitoring for divide-by-zero faults in dmesg.

Typical attack path

1. Obtain local shell or user context on the target system
2. Load or configure the stmmac driver with tc-cbs enabled
3. Issue tc commands that set port_transmit_rate_kbps to zero
4. Disable tc-cbs offload, triggering the unguarded div_s64 call
5. Observe kernel panic or oops and resulting denial of service

How to detect it

Search kernel logs and crash dumps for division-by-zero faults originating from the stmmac driver, especially around calls to div_s64 when tc-cbs configuration is modified.

• divide error: 0000 [#1] SMP
• RIP: 0010:div_s64
• stmmac_tc_setup_cbs

What your security team should do

• Prioritize patching any systems exposing stmmac interfaces within the next maintenance window
• Add the fixed commit hash to internal kernel build pipelines and CI checks
• Monitor for kernel oops reports referencing stmmac and div_s64 until patches are deployed