# CVE-2024-44976: linux: In the Linux kernel, the following vulnerability has been resolved:  ata: pata_macio: Fix DMA table overflow  Kolbjør...

CVE-2024-44976 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-44976, released September 4, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-44976
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0020
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 4, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  ata: pata_macio: Fix DMA table overflow  Kolbjørn and Jonáš reported that their 32-bit PowerMacs were crashing in pata-macio since commit 09fe2bfa6b83 ("ata: pata_macio: Fix max_segment_size with PAGE_SIZE == 64K").  For example:    kernel BUG at drivers/ata/pata_macio.c:544!   Oops: Exception in kernel mode, sig: 5 [#1]   BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 DEBUG_PAGEALLOC PowerMac   ...   NIP pata_macio_qc_prep+0xf4/0x190   LR  pata_macio_qc_prep+0xfc/0x190   Call Trace:     0xc1421660 (unreliable)     ata_qc_issue+0x14c/0x2d4     __ata_scsi_queuecmd+0x200/0x53c     ata_scsi_queuecmd+0x50/0xe0     scsi_queue_rq+0x788/0xb1c     __blk_mq_issue_directly+0x58/0xf4     blk_mq_plug_issue_direct+0x8c/0x1b4     blk_mq_flush_plug_list.part.0+0x584/0x5e0     __blk_flush_plug+0xf8/0x194     __submit_bio+0x1b8/0x2e0     submit_bio_noacct_nocheck+0x230/0x304     btrfs_work_helper+0x200/0x338     process_one_work+0x1a8/0x338     worker_thread+0x364/0x4c0     kthread+0x100/0x104     start_kernel_thread+0x10/0x14  That commit increased max_segment_size to 64KB, with the justification that the SCSI core was already using that size when PAGE_SIZE == 64KB, and that there was existing logic to split over-sized requests.  However with a sufficiently large request, the splitting logic causes each sg to be split into two commands in the DMA table, leading to overflow of the DMA table, triggering the BUG_ON().  With default settings the bug doesn't trigger, because the request size is limited by max_sectors_kb == 1280, however max_sectors_kb can be increased, and apparently some distros do that by default using udev rules.  Fix the bug for 4KB kernels by reverting to the old max_segment_size.  For 64KB kernels the sg_tablesize needs to be halved, to allow for the possibility that each sg will be split into two.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.10.7-1 | [DEBIAN-CVE-2024-44976](https://patchblox.com/security/data/fix/linux/debian-cve-2024-44976.md) | Sep 4, 2024 |
| Linux | linux Debian 14 | 6.10.7-1 | [DEBIAN-CVE-2024-44976](https://patchblox.com/security/data/fix/linux/debian-cve-2024-44976.md) | Sep 4, 2024 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.