CVE-2024-53138

net/mlx5e: kTLS, Fix incorrect page refcounting

State: Published
Severity: 9.8 Critical
Published: Dec 4, 2024
Updated: Oct 15, 2026
Reserved: Nov 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: kTLS, Fix incorrect page refcounting

The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.

This is an issue when using pages from large folios: the get_page() references are stored on the folio page while the page_ref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times.

This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 ("nfs: add support for large folios")).

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	84d1bb2b139e0184b1754aa1b5776186b475fce8 to before a0ddb20a748b122ea86003485f7992fa5e84cc95Affected 84d1bb2b139e0184b1754aa1b5776186b475fce8 to before ffad2ac8c859c1c1a981fe9c4f7ff925db684a43Affected 84d1bb2b139e0184b1754aa1b5776186b475fce8 to before c7b97f9e794d8e2bbaa50e1d6c230196fd214b5eAffected 84d1bb2b139e0184b1754aa1b5776186b475fce8 to before 69fbd07f17b0fdaf8970bc705f5bf115c297839dAffected 84d1bb2b139e0184b1754aa1b5776186b475fce8 to before 93a14620b97c911489a5b008782f3d9b0c4aeff4Affected 84d1bb2b139e0184b1754aa1b5776186b475fce8 to before 2723e8b2cbd486cb96e5a61b22473f7fd62e18dfAffected 84d1bb2b139e0184b1754aa1b5776186b475fce8 to before dd6e972cc5890d91d6749bb48e3912721c4e4b25Affected
LinuxLinux	5.4Affected before 5.4Not affected 5.4.287 through 5.4.Not affected 5.10.231 through 5.10.Not affected 5.15.174 through 5.15.Not affected 6.1.119 through 6.1.Not affected 6.6.63 through 6.6.Not affected 6.11.10 through 6.11.Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

84d1bb2b139e0184b1754aa1b5776186b475fce8 to before a0ddb20a748b122ea86003485f7992fa5e84cc95Affected
84d1bb2b139e0184b1754aa1b5776186b475fce8 to before ffad2ac8c859c1c1a981fe9c4f7ff925db684a43Affected
84d1bb2b139e0184b1754aa1b5776186b475fce8 to before c7b97f9e794d8e2bbaa50e1d6c230196fd214b5eAffected
84d1bb2b139e0184b1754aa1b5776186b475fce8 to before 69fbd07f17b0fdaf8970bc705f5bf115c297839dAffected
84d1bb2b139e0184b1754aa1b5776186b475fce8 to before 93a14620b97c911489a5b008782f3d9b0c4aeff4Affected
84d1bb2b139e0184b1754aa1b5776186b475fce8 to before 2723e8b2cbd486cb96e5a61b22473f7fd62e18dfAffected
84d1bb2b139e0184b1754aa1b5776186b475fce8 to before dd6e972cc5890d91d6749bb48e3912721c4e4b25Affected

LinuxLinux

5.4Affected
before 5.4Not affected
5.4.287 through 5.4.*Not affected
5.10.231 through 5.10.*Not affected
5.15.174 through 5.15.*Not affected
6.1.119 through 6.1.*Not affected
6.6.63 through 6.6.*Not affected
6.11.10 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.