CVE-2024-56719

What it actually does

Incorrect DMA cookie assignment in stmmac_tso_xmit when priv->dma_cap.addr64 > 32 causes stmmac_tx_clean to pass an offset value to dma_unmap_single, violating DMA API invariants and producing oops or DMA-API-DEBUG warnings on transmit.

Why it matters to the business

Systems using affected stmmac Ethernet controllers experience kernel crashes or Tx DMA map failures during normal network traffic, leading to loss of network connectivity and potential service disruption on Linux hosts.

How an attack unfolds

An attacker or workload triggers TSO transmission of a non-paged SKB on hardware with 64-bit DMA addressing; the mismatched cookie later passed to dma_unmap_single causes the kernel to oops or log DMA misuse, resulting in denial of service.

How to fix it

Update the Linux kernel to commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c or later; rebuild and deploy the fixed kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c; exercise TSO traffic while monitoring for absence of Tx DMA map failures and DMA-API-DEBUG warnings.

Typical attack path

1. Send network traffic that exercises TSO path in stmmac driver
2. Kernel performs dma_map_single and later stores offset cookie in tx_skbuff_dma
3. stmmac_tx_clean calls dma_unmap_single with mismatched cookie
4. DMA API detects misuse or hardware access fails, triggering oops

How to detect it

Search kernel logs and dmesg for strings indicating Tx DMA map failures or DMA-API misuse warnings on stmmac devices; no known post-exploitation artifacts exist.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all stmmac-based systems
• Monitor kernel logs for DMA map failures until patches are applied
• Test the updated kernel under representative network workloads before broad rollout