Critical 10.0Published Dec 29, 2024

CVE-2024-56719net: stmmac: fix TSO DMA API usage causing oops

Updated under an hour ago (Oct 28, 2026, 7:00 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s members to be later in stmmac_tso_xmit(). The buf (dma cookie) and len stored in this structure are passed to dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that the dma cookie passed to dma_unmap_single() is the same as the value returned from dma_map_single(). However, by moving the assignment later, this is not the case when priv->dma_cap.addr64 > 32 as "des" is offset by proto_hdr_len. This causes problems such as: dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed and with DMA_API_DEBUG enabled: DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes] Fix this by maintaining "des" as the original DMA cookie, and use tso_des to pass the offset DMA cookie to stmmac_tso_allocator(). Full details of the crashes can be found at: https://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/ https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/

CVSS: 10.0 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ece593fc9c00741b682869d3f3dc584d37b7c9df before 05968b6dd0ffc65d7386608b11a11fb4fdfc9f36; from a3ff23f7c3f0e13f718900803e090fd3997d6bc9 before 6abcdc9a73274052a9e96a1926994ecf9aedad82; from 07c9c26e37542486e34d767505e842f48f29c3f6 before db3667c9bbfbbf5de98e6c9542f7e03fb5243286; 66600fac7a984dea4ae095411f644770b2561ede builds before 9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2; 66600fac7a984dea4ae095411f644770b2561ede builds before 4c49f38e20a57f8abaebdf95b369295b153d1f8e; 58d23d835eb498336716cca55b5714191a309286; from 5.15.171 before 5.15.209; from 6.1.116 before 6.1.167; and 2 more ranges	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.15.171 before 5.16; from 6.1.116 before 6.2; from 6.6.60 before 6.6.68; from 6.11.7 before 6.12.7; 6.13; 6.13	NVD

References

References

https://git.kernel.org/stable/c/05968b6dd0ffc65d7386608b11a11fb4fdfc9f36
https://git.kernel.org/stable/c/6abcdc9a73274052a9e96a1926994ecf9aedad82
https://git.kernel.org/stable/c/db3667c9bbfbbf5de98e6c9542f7e03fb5243286	patch
https://git.kernel.org/stable/c/9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2	patch
https://git.kernel.org/stable/c/4c49f38e20a57f8abaebdf95b369295b153d1f8e	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.