CVE-2024-53138 (GCVE-0-2024-53138)

Vulnerability from cvelistv5 – Published: 2024-12-04 14:20 – Updated: 2026-08-05 11:44
VLAI
Title
net/mlx5e: kTLS, Fix incorrect page refcounting
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix incorrect page refcounting The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used. This is an issue when using pages from large folios: the get_page() references are stored on the folio page while the page_ref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times. This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 ("nfs: add support for large folios")).
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < a0ddb20a748b122ea86003485f7992fa5e84cc95 (git)
Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < ffad2ac8c859c1c1a981fe9c4f7ff925db684a43 (git)
Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e (git)
Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < 69fbd07f17b0fdaf8970bc705f5bf115c297839d (git)
Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < 93a14620b97c911489a5b008782f3d9b0c4aeff4 (git)
Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < 2723e8b2cbd486cb96e5a61b22473f7fd62e18df (git)
Affected: 84d1bb2b139e0184b1754aa1b5776186b475fce8 , < dd6e972cc5890d91d6749bb48e3912721c4e4b25 (git)
Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 5.4.287 , ≤ 5.4.* (semver)
Unaffected: 5.10.231 , ≤ 5.10.* (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.119 , ≤ 6.1.* (semver)
Unaffected: 6.6.63 , ≤ 6.6.* (semver)
Unaffected: 6.11.10 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:29:40.765Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a0ddb20a748b122ea86003485f7992fa5e84cc95",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "ffad2ac8c859c1c1a981fe9c4f7ff925db684a43",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "69fbd07f17b0fdaf8970bc705f5bf115c297839d",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "93a14620b97c911489a5b008782f3d9b0c4aeff4",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "2723e8b2cbd486cb96e5a61b22473f7fd62e18df",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            },
            {
              "lessThan": "dd6e972cc5890d91d6749bb48e3912721c4e4b25",
              "status": "affected",
              "version": "84d1bb2b139e0184b1754aa1b5776186b475fce8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.119",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.63",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.10",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix incorrect page refcounting\n\nThe kTLS tx handling code is using a mix of get_page() and\npage_ref_inc() APIs to increment the page reference. But on the release\npath (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.\n\nThis is an issue when using pages from large folios: the get_page()\nreferences are stored on the folio page while the page_ref_inc()\nreferences are stored directly in the given page. On release the folio\npage will be dereferenced too many times.\n\nThis was found while doing kTLS testing with sendfile() + ZC when the\nserved file was read from NFS on a kernel with NFS large folios support\n(commit 49b29a573da8 (\"nfs: add support for large folios\"))."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable resync/DUMP path is entered only when a TCP segment is retransmitted on a kTLS-offloaded connection (`priv_tx-\u003eexpected_seq != seq`), and retransmission behavior is dictated entirely by the remote TLS peer\u0027s ACK/SACK behavior. A remote client of an mlx5e kTLS-offloaded TLS server reaches this code purely by sending network traffic, with no local access.\nAC:L - Once a client requests a sendfile()-served object, forcing retransmissions by dropping segments or withholding ACKs is trivially and repeatedly achievable, and the refcount over-decrement is deterministic (n=3 for the default 1500-byte MTU with 4K pages) rather than racy. No memory layout or timing condition outside the attacker\u0027s control must be won.\nPR:N - A public TLS/HTTPS endpoint accepts connections from anyone; no credentials, account, or local privileges are needed to open a connection, request a file, and manipulate the TCP ACK stream. The attacker acts purely as an ordinary remote TLS client.\nUI:N - The attacker drives the entire sequence \u2014 connect, request data, suppress ACKs \u2014 with no action required from any local user or administrator beyond the server already running its normal kTLS-offloaded workload.\nS:U - The corruption is of kernel page-cache refcounts and kernel memory, all within the host kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The folio refcount underflow frees an in-use page-cache folio that is still in the address_space and still referenced by TLS record frags and the retransmit queue; once the physical page is reallocated, its new contents (other tenants\u0027 file data, anonymous memory, or kernel objects) can be transmitted back over the attacker\u0027s own TLS connection, giving a broad memory-disclosure primitive.\nI:H - The same premature free gives a write primitive \u2014 page-cache writeback and continued DMA/TLS use write into memory that has been reallocated to other kernel objects, which is the classic UAF heap-spray path to control-flow hijack. The tail page\u0027s raw `_refcount` is also left permanently corrupted.\nA:H - Refcount underflow on a live folio trips `VM_BUG_ON_FOLIO`/`bad_page()` and frees memory that is still in use, producing oopses, page-allocator corruption, and kernel panic; the attacker can repeat this at will over many connections."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:01.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a0ddb20a748b122ea86003485f7992fa5e84cc95"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffad2ac8c859c1c1a981fe9c4f7ff925db684a43"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d"
        },
        {
          "url": "https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd6e972cc5890d91d6749bb48e3912721c4e4b25"
        }
      ],
      "title": "net/mlx5e: kTLS, Fix incorrect page refcounting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53138",
    "datePublished": "2024-12-04T14:20:43.395Z",
    "dateReserved": "2024-11-19T17:17:24.996Z",
    "dateUpdated": "2026-08-05T11:44:01.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53138",
      "date": "2026-08-05",
      "epss": "0.00545",
      "percentile": "0.42669"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.4\", \"versionEndExcluding\": \"6.1.119\", \"matchCriteriaId\": \"56055120-91DC-4FB3-811E-77C96E66E078\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.63\", \"matchCriteriaId\": \"8800BB45-48BC-4B52-BDA5-B1E4633F42E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.11.10\", \"matchCriteriaId\": \"C256F46A-AFDD-4B99-AA4F-67D9D9D2C55A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"24B88717-53F5-42AA-9B72-14C707639E3F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"1EF8CD82-1EAE-4254-9545-F85AB94CF90F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: kTLS, Fix incorrect page refcounting\\n\\nThe kTLS tx handling code is using a mix of get_page() and\\npage_ref_inc() APIs to increment the page reference. But on the release\\npath (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.\\n\\nThis is an issue when using pages from large folios: the get_page()\\nreferences are stored on the folio page while the page_ref_inc()\\nreferences are stored directly in the given page. On release the folio\\npage will be dereferenced too many times.\\n\\nThis was found while doing kTLS testing with sendfile() + ZC when the\\nserved file was read from NFS on a kernel with NFS large folios support\\n(commit 49b29a573da8 (\\\"nfs: add support for large folios\\\")).\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: kTLS, Fix wrong page refcounting El c\\u00f3digo de manejo de tx de kTLS usa una combinaci\\u00f3n de API get_page() y page_ref_inc() para incrementar la referencia de p\\u00e1gina. Pero en la ruta de lanzamiento (mlx5e_ktls_tx_handle_resync_dump_comp()), solo se usa put_page(). Este es un problema cuando se usan p\\u00e1ginas de folios grandes: las referencias get_page() se almacenan en la p\\u00e1gina del folio mientras que las referencias page_ref_inc() se almacenan directamente en la p\\u00e1gina dada. En el lanzamiento, la p\\u00e1gina del folio se desreferenciar\\u00e1 demasiadas veces. Esto se encontr\\u00f3 al hacer pruebas de kTLS con sendfile() + ZC cuando el archivo servido se ley\\u00f3 desde NFS en un kernel con soporte para folios grandes de NFS (commit 49b29a573da8 (\\\"nfs: agregar soporte para folios grandes\\\")).\"}]",
      "id": "CVE-2024-53138",
      "lastModified": "2024-12-14T21:15:38.140",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-12-04T15:15:13.983",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a0ddb20a748b122ea86003485f7992fa5e84cc95\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/dd6e972cc5890d91d6749bb48e3912721c4e4b25\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ffad2ac8c859c1c1a981fe9c4f7ff925db684a43\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:16:26.000Z",
      "cve": "CVE-2024-53138",
      "id": "msrc_CVE-2024-53138",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/mlx5e: kTLS, Fix incorrect page refcounting",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-53138.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53138\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-04T15:15:13.983\",\"lastModified\":\"2026-08-04T11:21:57.280\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: kTLS, Fix incorrect page refcounting\\n\\nThe kTLS tx handling code is using a mix of get_page() and\\npage_ref_inc() APIs to increment the page reference. But on the release\\npath (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.\\n\\nThis is an issue when using pages from large folios: the get_page()\\nreferences are stored on the folio page while the page_ref_inc()\\nreferences are stored directly in the given page. On release the folio\\npage will be dereferenced too many times.\\n\\nThis was found while doing kTLS testing with sendfile() + ZC when the\\nserved file was read from NFS on a kernel with NFS large folios support\\n(commit 49b29a573da8 (\\\"nfs: add support for large folios\\\")).\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: kTLS, Fix wrong page refcounting El c\u00f3digo de manejo de tx de kTLS usa una combinaci\u00f3n de API get_page() y page_ref_inc() para incrementar la referencia de p\u00e1gina. Pero en la ruta de lanzamiento (mlx5e_ktls_tx_handle_resync_dump_comp()), solo se usa put_page(). Este es un problema cuando se usan p\u00e1ginas de folios grandes: las referencias get_page() se almacenan en la p\u00e1gina del folio mientras que las referencias page_ref_inc() se almacenan directamente en la p\u00e1gina dada. En el lanzamiento, la p\u00e1gina del folio se desreferenciar\u00e1 demasiadas veces. Esto se encontr\u00f3 al hacer pruebas de kTLS con sendfile() + ZC cuando el archivo servido se ley\u00f3 desde NFS en un kernel con soporte para folios grandes de NFS (commit 49b29a573da8 (\\\"nfs: agregar soporte para folios grandes\\\")).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"84d1bb2b139e0184b1754aa1b5776186b475fce8\",\"lessThan\":\"a0ddb20a748b122ea86003485f7992fa5e84cc95\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84d1bb2b139e0184b1754aa1b5776186b475fce8\",\"lessThan\":\"ffad2ac8c859c1c1a981fe9c4f7ff925db684a43\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84d1bb2b139e0184b1754aa1b5776186b475fce8\",\"lessThan\":\"c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84d1bb2b139e0184b1754aa1b5776186b475fce8\",\"lessThan\":\"69fbd07f17b0fdaf8970bc705f5bf115c297839d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84d1bb2b139e0184b1754aa1b5776186b475fce8\",\"lessThan\":\"93a14620b97c911489a5b008782f3d9b0c4aeff4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84d1bb2b139e0184b1754aa1b5776186b475fce8\",\"lessThan\":\"2723e8b2cbd486cb96e5a61b22473f7fd62e18df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"84d1bb2b139e0184b1754aa1b5776186b475fce8\",\"lessThan\":\"dd6e972cc5890d91d6749bb48e3912721c4e4b25\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_tx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.287\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.231\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.119\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.63\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.10\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4\",\"versionEndExcluding\":\"6.1.119\",\"matchCriteriaId\":\"56055120-91DC-4FB3-811E-77C96E66E078\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.63\",\"matchCriteriaId\":\"8800BB45-48BC-4B52-BDA5-B1E4633F42E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.10\",\"matchCriteriaId\":\"C256F46A-AFDD-4B99-AA4F-67D9D9D2C55A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B88717-53F5-42AA-9B72-14C707639E3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EF8CD82-1EAE-4254-9545-F85AB94CF90F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a0ddb20a748b122ea86003485f7992fa5e84cc95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dd6e972cc5890d91d6749bb48e3912721c4e4b25\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ffad2ac8c859c1c1a981fe9c4f7ff925db684a43\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:03:15+00:00",
      "cve": "CVE-2024-53138",
      "id": "CVE-2024-53138",
      "initial_release_date": "2024-12-04T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: kTLS, Fix incorrect page refcounting",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53138.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:22:15Z",
      "cve": "CVE-2024-53138",
      "id": "CVE-2024-53138",
      "initial_release_date": "2024-12-05T00:15:55Z",
      "product_status:known_affected": "540",
      "product_status:known_not_affected": "204",
      "product_status:recommended": "411",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-53138",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-53138.json",
      "version": "71"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.