CVE-2024-53138
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Linux kernel, the mlx5e driver for kTLS has an incorrect page refcounting issue. Mixing get_page() and page_ref_inc() APIs for incrementing references and using only put_page() on release leads to over-dereferencing the folio page, potentially causing memory errors.
Risk Assessment
The vulnerability may lead to memory corruption or system crash when using kTLS with large folios, especially with sendfile() and ZC when serving files from NFS.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix that unifies page reference counting in the kTLS code.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix incorrect page refcounting The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used. This is an issue when using pages from large folios: the get_page() references are stored on the folio page while the page_ref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times. This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 ("nfs: add support for large folios")).