PT-2024-21467 · Linux+1 · Linux Kernel+1

Petr Tesarik · Published 2024-02-07 · Updated 2024-11-06 · CVE-2024-26690

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the protection of updates of 64-bit statistics counters in the Linux kernel. A comment in <linux/u64 stats sync.h> explains that the write side of struct u64 stats sync must ensure mutual exclusion, or one seqcount update could be lost on 32-bit platforms, thus blocking readers forever. Such lockups have been observed in real-world scenarios after stmmac xmit() on one CPU raced with stmmac napi poll tx() on another CPU. The fix involves splitting the statics into three parts: fields updated only under the tx queue lock, fields updated only during NAPI poll, and fields updated only from interrupt context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-99

Related Identifiers

BDU:2025-04413

CVE-2024-26690

Affected Products

Linux Kernel

Red Os

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26690.json · Exploit
• https://bdu.fstec.ru/vul/2025-04413 · Security Note
• https://git.kernel.org/stable/c/9680b2ab54ba8d72581100e8c45471306101836e · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26690 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26690 · Vendor Advisory
• https://git.kernel.org/stable/c/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8 · Patch
• https://git.kernel.org/stable/c/e6af0f082a4b87b99ad033003be2a904a1791b3f · Patch
• https://osv.dev/vulnerability/CVE-2024-26690 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-26690 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-26690 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26690 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26690 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-26690 · Vendor Advisory
• https://git.kernel.org/linus/38cc3c6dcc09dc3a1800b5ec22aef643ca11eab8 · Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.18 · Note