Answer in brief
CVE-2024-56719 records a Medium severity (CVSS 5.5) vulnerability in net: stmmac: fix TSO DMA API usage causing oops. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2024-56719 records a Medium severity (CVSS 5.5) vulnerability in net: stmmac: fix TSO DMA API usage causing oops. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ece593fc9c00741b682869d3f3dc584d37b7c9df <05968b6dd0ffc65d7386608b11a11fb4fdfc9f36 || >=a3ff23f7c3f0e13f718900803e090fd3997d6bc9 <6abcdc9a73274052a9e96a1926994ecf9aedad82 || >=07c9c26e37542486e34d767505e842f48f29c3f6 <db3667c9bbfbbf5de98e6c9542f7e03fb5243286 || >=66600fac7a984dea4ae095411f644770b2561ede <9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2 || >=66600fac7a984dea4ae095411f644770b2561ede <4c49f38e20a57f8abaebdf95b369295b153d1f8e || 58d23d835eb498336716cca55b5714191a309286 || >=5.15.171 <5.15.209 || >=6.1.116 <6.1.167 || >=6.6.60 <6.6.68 || >=6.11.7 <6.12 | 05968b6dd0ffc65d7386608b11a11fb4fdfc9f36, 6abcdc9a73274052a9e96a1926994ecf9aedad82, db3667c9bbfbbf5de98e6c9542f7e03fb5243286, 9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2, 4c49f38e20a57f8abaebdf95b369295b153d1f8e, 5.15.209, 6.1.167, 6.6.68, 6.12 |
| Linux/Linuxgeneric | 6.12 | Not reported |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
Published upstream
Dec 29, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 14, 2026
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s members to be later in stmmac_tso_xmit(). The buf (dma cookie) and len stored in this structure are passed to dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that the dma cookie passed to dma_unmap_single() is the same as the value returned from dma_map_single(). However, by moving the assignment later, this is not the case when priv->dma_cap.addr64 > 32 as "des" is offset by proto_hdr_len. This causes problems such as: dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed and with DMA_API_DEBUG enabled: DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes] Fix this by maintaining "des" as the original DMA cookie, and use tso_des to pass the offset DMA cookie to stmmac_tso_allocator(). Full details of the crashes can be found at: https://lore.kernel.org/all/[email protected]/ https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/
Quoted source text, attributed separately from HOL analysis.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ece593fc9c00741b682869d3f3dc584d37b7c9df <05968b6dd0ffc65d7386608b11a11fb4fdfc9f36 || >=a3ff23f7c3f0e13f718900803e090fd3997d6bc9 <6abcdc9a73274052a9e96a1926994ecf9aedad82 || >=07c9c26e37542486e34d767505e842f48f29c3f6 <db3667c9bbfbbf5de98e6c9542f7e03fb5243286 || >=66600fac7a984dea4ae095411f644770b2561ede <9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2 || >=66600fac7a984dea4ae095411f644770b2561ede <4c49f38e20a57f8abaebdf95b369295b153d1f8e || 58d23d835eb498336716cca55b5714191a309286 || >=5.15.171 <5.15.209 || >=6.1.116 <6.1.167 || >=6.6.60 <6.6.68 || >=6.11.7 <6.12 | 05968b6dd0ffc65d7386608b11a11fb4fdfc9f36, 6abcdc9a73274052a9e96a1926994ecf9aedad82, db3667c9bbfbbf5de98e6c9542f7e03fb5243286, 9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2, 4c49f38e20a57f8abaebdf95b369295b153d1f8e, 5.15.209, 6.1.167, 6.6.68, 6.12 |
| Linux/Linuxgeneric | 6.12 | Not reported |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.6 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
Published upstream
Dec 29, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 14, 2026
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s members to be later in stmmac_tso_xmit(). The buf (dma cookie) and len stored in this structure are passed to dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that the dma cookie passed to dma_unmap_single() is the same as the value returned from dma_map_single(). However, by moving the assignment later, this is not the case when priv->dma_cap.addr64 > 32 as "des" is offset by proto_hdr_len. This causes problems such as: dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed and with DMA_API_DEBUG enabled: DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes] Fix this by maintaining "des" as the original DMA cookie, and use tso_des to pass the offset DMA cookie to stmmac_tso_allocator(). Full details of the crashes can be found at: https://lore.kernel.org/all/[email protected]/ https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/
Quoted source text, attributed separately from HOL analysis.