Vulnerability-Lookup

FKIE_CVE-2024-53138

Vulnerability from fkie_nvd - Published: 2024-12-04 15:15 - Updated: 2026-08-04 11:21

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix incorrect page refcounting The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used. This is an issue when using pages from large folios: the get_page() references are stored on the folio page while the page_ref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times. This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 ("nfs: add support for large folios")).

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a0ddb20a748b122ea86003485f7992fa5e84cc95
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/dd6e972cc5890d91d6749bb48e3912721c4e4b25	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ffad2ac8c859c1c1a981fe9c4f7ff925db684a43
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.12
linux	linux_kernel	6.12
linux	linux_kernel	6.12
linux	linux_kernel	6.12
linux	linux_kernel	6.12
linux	linux_kernel	6.12
linux	linux_kernel	6.12

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a0ddb20a748b122ea86003485f7992fa5e84cc95",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "ffad2ac8c859c1c1a981fe9c4f7ff925db684a43",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "69fbd07f17b0fdaf8970bc705f5bf115c297839d",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "93a14620b97c911489a5b008782f3d9b0c4aeff4",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "2723e8b2cbd486cb96e5a61b22473f7fd62e18df",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "dd6e972cc5890d91d6749bb48e3912721c4e4b25",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "56055120-91DC-4FB3-811E-77C96E66E078",
              "versionEndExcluding": "6.1.119",
              "versionStartIncluding": "5.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8800BB45-48BC-4B52-BDA5-B1E4633F42E5",
              "versionEndExcluding": "6.6.63",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C256F46A-AFDD-4B99-AA4F-67D9D9D2C55A",
              "versionEndExcluding": "6.11.10",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "24B88717-53F5-42AA-9B72-14C707639E3F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "1EF8CD82-1EAE-4254-9545-F85AB94CF90F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix incorrect page refcounting\n\nThe kTLS tx handling code is using a mix of get_page() and\npage_ref_inc() APIs to increment the page reference. But on the release\npath (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.\n\nThis is an issue when using pages from large folios: the get_page()\nreferences are stored on the folio page while the page_ref_inc()\nreferences are stored directly in the given page. On release the folio\npage will be dereferenced too many times.\n\nThis was found while doing kTLS testing with sendfile() + ZC when the\nserved file was read from NFS on a kernel with NFS large folios support\n(commit 49b29a573da8 (\"nfs: add support for large folios\"))."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: kTLS, Fix wrong page refcounting El c\u00f3digo de manejo de tx de kTLS usa una combinaci\u00f3n de API get_page() y page_ref_inc() para incrementar la referencia de p\u00e1gina. Pero en la ruta de lanzamiento (mlx5e_ktls_tx_handle_resync_dump_comp()), solo se usa put_page(). Este es un problema cuando se usan p\u00e1ginas de folios grandes: las referencias get_page() se almacenan en la p\u00e1gina del folio mientras que las referencias page_ref_inc() se almacenan directamente en la p\u00e1gina dada. En el lanzamiento, la p\u00e1gina del folio se desreferenciar\u00e1 demasiadas veces. Esto se encontr\u00f3 al hacer pruebas de kTLS con sendfile() + ZC cuando el archivo servido se ley\u00f3 desde NFS en un kernel con soporte para folios grandes de NFS (commit 49b29a573da8 (\"nfs: agregar soporte para folios grandes\"))."
    }
  ],
  "id": "CVE-2024-53138",
  "lastModified": "2026-08-04T11:21:57.280",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-12-04T15:15:13.983",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a0ddb20a748b122ea86003485f7992fa5e84cc95"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/dd6e972cc5890d91d6749bb48e3912721c4e4b25"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ffad2ac8c859c1c1a981fe9c4f7ff925db684a43"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2024-53138 (GCVE-0-2024-53138)

Vulnerability from cvelistv5 – Published: 2024-12-04 14:20 – Updated: 2026-08-05 11:44

Title

net/mlx5e: kTLS, Fix incorrect page refcounting

Summary

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/a0ddb20a748b122ea…
https://git.kernel.org/stable/c/ffad2ac8c859c1c1a…
https://git.kernel.org/stable/c/c7b97f9e794d8e2bb…
https://git.kernel.org/stable/c/69fbd07f17b0fdaf8…
https://git.kernel.org/stable/c/93a14620b97c91148…
https://git.kernel.org/stable/c/2723e8b2cbd486cb9…
https://git.kernel.org/stable/c/dd6e972cc5890d91d…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < a0ddb20a748b122ea86003485f7992fa5e84cc95 (git) Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < ffad2ac8c859c1c1a981fe9c4f7ff925db684a43 (git) Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e (git) Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < 69fbd07f17b0fdaf8970bc705f5bf115c297839d (git) Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < 93a14620b97c911489a5b008782f3d9b0c4aeff4 (git) Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < 2723e8b2cbd486cb96e5a61b22473f7fd62e18df (git) Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < dd6e972cc5890d91d6749bb48e3912721c4e4b25 (git)
Linux	Linux	Affected: 5.4 Unaffected: 0 , < 5.4 (semver) Unaffected: 5.4.287 , ≤ 5.4.* (semver) Unaffected: 5.10.231 , ≤ 5.10.* (semver) Unaffected: 5.15.174 , ≤ 5.15.* (semver) Unaffected: 6.1.119 , ≤ 6.1.* (semver) Unaffected: 6.6.63 , ≤ 6.6.* (semver) Unaffected: 6.11.10 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:29:40.765Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a0ddb20a748b122ea86003485f7992fa5e84cc95",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "ffad2ac8c859c1c1a981fe9c4f7ff925db684a43",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "69fbd07f17b0fdaf8970bc705f5bf115c297839d",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "93a14620b97c911489a5b008782f3d9b0c4aeff4",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "2723e8b2cbd486cb96e5a61b22473f7fd62e18df",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "dd6e972cc5890d91d6749bb48e3912721c4e4b25",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.119",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.63",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.10",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix incorrect page refcounting\n\nThe kTLS tx handling code is using a mix of get_page() and\npage_ref_inc() APIs to increment the page reference. But on the release\npath (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.\n\nThis is an issue when using pages from large folios: the get_page()\nreferences are stored on the folio page while the page_ref_inc()\nreferences are stored directly in the given page. On release the folio\npage will be dereferenced too many times.\n\nThis was found while doing kTLS testing with sendfile() + ZC when the\nserved file was read from NFS on a kernel with NFS large folios support\n(commit 49b29a573da8 (\"nfs: add support for large folios\"))."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable resync/DUMP path is entered only when a TCP segment is retransmitted on a kTLS-offloaded connection (`priv_tx-\u003eexpected_seq != seq`), and retransmission behavior is dictated entirely by the remote TLS peer\u0027s ACK/SACK behavior. A remote client of an mlx5e kTLS-offloaded TLS server reaches this code purely by sending network traffic, with no local access.\nAC:L - Once a client requests a sendfile()-served object, forcing retransmissions by dropping segments or withholding ACKs is trivially and repeatedly achievable, and the refcount over-decrement is deterministic (n=3 for the default 1500-byte MTU with 4K pages) rather than racy. No memory layout or timing condition outside the attacker\u0027s control must be won.\nPR:N - A public TLS/HTTPS endpoint accepts connections from anyone; no credentials, account, or local privileges are needed to open a connection, request a file, and manipulate the TCP ACK stream. The attacker acts purely as an ordinary remote TLS client.\nUI:N - The attacker drives the entire sequence \u2014 connect, request data, suppress ACKs \u2014 with no action required from any local user or administrator beyond the server already running its normal kTLS-offloaded workload.\nS:U - The corruption is of kernel page-cache refcounts and kernel memory, all within the host kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The folio refcount underflow frees an in-use page-cache folio that is still in the address_space and still referenced by TLS record frags and the retransmit queue; once the physical page is reallocated, its new contents (other tenants\u0027 file data, anonymous memory, or kernel objects) can be transmitted back over the attacker\u0027s own TLS connection, giving a broad memory-disclosure primitive.\nI:H - The same premature free gives a write primitive \u2014 page-cache writeback and continued DMA/TLS use write into memory that has been reallocated to other kernel objects, which is the classic UAF heap-spray path to control-flow hijack. The tail page\u0027s raw `_refcount` is also left permanently corrupted.\nA:H - Refcount underflow on a live folio trips `VM_BUG_ON_FOLIO`/`bad_page()` and frees memory that is still in use, producing oopses, page-allocator corruption, and kernel panic; the attacker can repeat this at will over many connections."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:01.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a0ddb20a748b122ea86003485f7992fa5e84cc95"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffad2ac8c859c1c1a981fe9c4f7ff925db684a43"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d"
        },
        {
          "url": "https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd6e972cc5890d91d6749bb48e3912721c4e4b25"
        }
      ],
      "title": "net/mlx5e: kTLS, Fix incorrect page refcounting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53138",
    "datePublished": "2024-12-04T14:20:43.395Z",
    "dateReserved": "2024-11-19T17:17:24.996Z",
    "dateUpdated": "2026-08-05T11:44:01.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2024-53138

CVE-2024-53138 (GCVE-0-2024-53138)

Tags

Sightings

Nomenclature

Related by attack behaviour