CVE-2024-26680: Vulnerability in linux-libc-dev - Fix DMA mapping for PTP hwts ring

linux Updated 02 Oct 2025

Summary

02/04/2024

Disclosed on

CVE-2024-26680

CVE

No i

Fix available

Medium

Severity

5.5

CVSS Score

CVE-2024-26680: In the Linux kernel, the following vulnerability has been resolved: net: atlantic: Fix DMA mapping for PTP hwts ring Function aq_ring_hwts_rx_alloc() maps extra AQ_CFG_RXDS_DEF bytes for PTP HWTS ring but then generic aq... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

linux-libc-dev is a package in the Debian operating system that provides the C library headers for the Linux kernel. These headers are necessary for compiling and linking programs that use system calls and other kernel interfaces. The package is an essential component for developers and system administrators working on Debian-based systems. However, a vulnerability has been discovered in the package that could potentially lead to security issues.

Vulnerability Detail

The vulnerability (CVE-2024-26680) in linux-libc-dev arises from a flaw in the net: atlantic component of the Linux kernel. The aq_ring_hwts_rx_alloc() function in this component maps extra AQ_CFG_RXDS_DEF bytes for the Precision Time Protocol (PTP) hardware timestamping (hwts) ring. However, the generic aq_ring_free() function does not account for this mapping, resulting in a mismatch between the size of the memory being freed and the size that was originally mapped. This can lead to memory corruption and potential security risks. The vulnerability has a CVSS score of 4.4, indicating a medium severity level.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

No workaround has been provided for this vulnerability. It is essential to update the linux-libc-dev package to the latest version to mitigate the risk.

Conclusion

The vulnerability in linux-libc-dev can be mitigated by updating the package to version 6.1.90-1 or later. It is crucial to stay updated with security patches and fixes to ensure the integrity and security of the system. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for linux →