{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26802", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.179Z", "datePublished": "2024-04-04T08:20:29.919Z", "dateUpdated": "2026-08-05T11:27:23.774Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:23.774Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstmmac: Clear variable when destroying workqueue\n\nCurrently when suspending driver and stopping workqueue it is checked whether\nworkqueue is not NULL and if so, it is destroyed.\nFunction destroy_workqueue() does drain queue and does clear variable, but\nit does not set workqueue variable to NULL. This can cause kernel/module\npanic if code attempts to clear workqueue that was not initialized.\n\nThis scenario is possible when resuming suspended driver in stmmac_resume(),\nbecause there is no handling for failed stmmac_hw_setup(),\nwhich can fail and return if DMA engine has failed to initialize,\nand workqueue is initialized after DMA engine.\nShould DMA engine fail to initialize, resume will proceed normally,\nbut interface won't work and TX queue will eventually timeout,\ncausing 'Reset adapter' error.\nThis then does destroy workqueue during reset process.\nAnd since workqueue is initialized after DMA engine and can be skipped,\nit will cause kernel/module panic.\n\nTo secure against this possible crash, set workqueue variable to NULL when\ndestroying workqueue.\n\nLog/backtrace from crash goes as follows:\n[88.031977]------------[ cut here ]------------\n[88.031985]NETDEV WATCHDOG: eth0 (sxgmac): transmit queue 1 timed out\n[88.032017]WARNING: CPU: 0 PID: 0 at net/sched/sch_generic.c:477 dev_watchdog+0x390/0x398\n \n[88.032251]---[ end trace e70de432e4d5c2c0 ]---\n[88.032282]sxgmac 16d88000.ethernet eth0: Reset adapter.\n[88.036359]------------[ cut here ]------------\n[88.036519]Call trace:\n[88.036523] flush_workqueue+0x3e4/0x430\n[88.036528] drain_workqueue+0xc4/0x160\n[88.036533] destroy_workqueue+0x40/0x270\n[88.036537] stmmac_fpe_stop_wq+0x4c/0x70\n[88.036541] stmmac_release+0x278/0x280\n[88.036546] __dev_close_many+0xcc/0x158\n[88.036551] dev_close_many+0xbc/0x190\n[88.036555] dev_close.part.0+0x70/0xc0\n[88.036560] dev_close+0x24/0x30\n[88.036564] stmmac_service_task+0x110/0x140\n[88.036569] process_one_work+0x1d8/0x4a0\n[88.036573] worker_thread+0x54/0x408\n[88.036578] kthread+0x164/0x170\n[88.036583] ret_from_fork+0x10/0x20\n[88.036588]---[ end trace e70de432e4d5c2c1 ]---\n[88.036597]Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable sequence is driven through local interfaces — PM suspend/resume, or netlink/ethtool operations (`ip link set mtu/down`, `ethtool -G/-L`) that call `stmmac_release()`/`stmmac_open()`; no remote packet processing reaches the double-destroy. The link-partner-driven FPE interrupt path only widens the window rather than being the primary trigger.\nAC:L - The attacker fully controls the release/reopen sequence and can induce the required reopen failure via ordinary memory pressure with maximum `ethtool -G` ring sizes, retrying as often as needed. The subsequent second `destroy_workqueue()` on the freed object is then deterministic, so no condition outside attacker influence is required.\nPR:L - On the affected deployment class (Android handsets, automotive ECUs, embedded/industrial controllers using dwmac4/XGMAC), a suspend/resume cycle is initiated by an unprivileged console user via logind or occurs automatically on screen-off/idle, and the crash then follows without further privilege once the watchdog fires. No root-only capability in the init namespace is inherently required to reach the state.\nUI:N - No victim action is needed — the second `stmmac_fpe_stop_wq()` is reached automatically by the netdev watchdog TX timeout and `stmmac_reset_subtask()` → `dev_close()`, or by the attacker's own subsequent interface operation.\nS:U - The freed `workqueue_struct` and the corrupted state are both kernel heap objects within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free on an RCU-freed slab object that is reallocatable during the seconds-to-minutes gap between the two destroys, and `drain_workqueue()`/`flush_workqueue()` read pointers and list heads out of it, giving a path to arbitrary kernel memory disclosure via heap grooming.\nI:H - `destroy_workqueue()` performs list removals, mutex operations, and refcount decrements through the dangling pointer, so a sprayed replacement object yields controlled kernel writes and a route to control-flow hijack.\nA:H - The bug reproducibly panics the kernel — the reporter's trace shows an unrecoverable fault inside `flush_workqueue()` during `stmmac_release()` — taking down the whole system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c" ], "versions": [ { "version": "5a5586112b929546e16029261a987c9197bfdfa2", "lessThan": "8e99556301172465c8fe33c7f78c39a3d4ce8462", "status": "affected", "versionType": "git" }, { "version": "5a5586112b929546e16029261a987c9197bfdfa2", "lessThan": "17ccd9798fe0beda3db212cfa3ebe373f605cbd6", "status": "affected", "versionType": "git" }, { "version": "5a5586112b929546e16029261a987c9197bfdfa2", "lessThan": "699b103e48ce32d03fc86c35b37ee8ae4288c7e3", "status": "affected", "versionType": "git" }, { "version": "5a5586112b929546e16029261a987c9197bfdfa2", "lessThan": "f72cf22dccc94038cbbaa1029cb575bf52e5cbc8", "status": "affected", "versionType": "git" }, { "version": "5a5586112b929546e16029261a987c9197bfdfa2", "lessThan": "8af411bbba1f457c33734795f024d0ef26d0963f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.151", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.81", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.21", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.151" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.81" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.7.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8e99556301172465c8fe33c7f78c39a3d4ce8462" }, { "url": "https://git.kernel.org/stable/c/17ccd9798fe0beda3db212cfa3ebe373f605cbd6" }, { "url": "https://git.kernel.org/stable/c/699b103e48ce32d03fc86c35b37ee8ae4288c7e3" }, { "url": "https://git.kernel.org/stable/c/f72cf22dccc94038cbbaa1029cb575bf52e5cbc8" }, { "url": "https://git.kernel.org/stable/c/8af411bbba1f457c33734795f024d0ef26d0963f" } ], "title": "stmmac: Clear variable when destroying workqueue", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26802", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-04-05T18:39:40.644650Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:48:39.143Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.590Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/8e99556301172465c8fe33c7f78c39a3d4ce8462", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/17ccd9798fe0beda3db212cfa3ebe373f605cbd6", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/699b103e48ce32d03fc86c35b37ee8ae4288c7e3", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/f72cf22dccc94038cbbaa1029cb575bf52e5cbc8", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8af411bbba1f457c33734795f024d0ef26d0963f", "tags": [ "x_transferred" ] } ] } ] } }