{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-53138",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-53138"
  ],
  "published": "2024-12-04T14:29:17Z",
  "summary": "net/mlx5e: kTLS, Fix incorrect page refcounting",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: kTLS, Fix incorrect page refcounting\n\nThe kTLS tx handling code is using a mix of get_page() and\npage_ref_inc() APIs to increment the page reference. But on the release\npath (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.\n\nThis is an issue when using pages from large folios: the get_page()\nreferences are stored on the folio page while the page_ref_inc()\nreferences are stored directly in the given page. On release the folio\npage will be dereferenced too many times.\n\nThis was found while doing kTLS testing with sendfile() + ZC when the\nserved file was read from NFS on a kernel with NFS large folios support\n(commit 49b29a573da8 (\"nfs: add support for large folios\")).",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.119",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53138"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a0ddb20a748b122ea86003485f7992fa5e84cc95"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ffad2ac8c859c1c1a981fe9c4f7ff925db684a43"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/dd6e972cc5890d91d6749bb48e3912721c4e4b25"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 9.8,
      "cvss_v3_severity": "Critical",
      "scenario": "AV:N - The vulnerable resync/DUMP path is entered only when a TCP segment is retransmitted on a kTLS-offloaded connection (`priv_tx->expected_seq != seq`), and retransmission behavior is dictated entirely by the remote TLS peer's ACK/SACK behavior. A remote client of an mlx5e kTLS-offloaded TLS server reaches this code purely by sending network traffic, with no local access.\nAC:L - Once a client requests a sendfile()-served object, forcing retransmissions by dropping segments or withholding ACKs is trivially and repeatedly achievable, and the refcount over-decrement is deterministic (n=3 for the default 1500-byte MTU with 4K pages) rather than racy. No memory layout or timing condition outside the attacker's control must be won.\nPR:N - A public TLS/HTTPS endpoint accepts connections from anyone; no credentials, account, or local privileges are needed to open a connection, request a file, and manipulate the TCP ACK stream. The attacker acts purely as an ordinary remote TLS client.\nUI:N - The attacker drives the entire sequence \u2014 connect, request data, suppress ACKs \u2014 with no action required from any local user or administrator beyond the server already running its normal kTLS-offloaded workload.\nS:U - The corruption is of kernel page-cache refcounts and kernel memory, all within the host kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The folio refcount underflow frees an in-use page-cache folio that is still in the address_space and still referenced by TLS record frags and the retransmit queue; once the physical page is reallocated, its new contents (other tenants' file data, anonymous memory, or kernel objects) can be transmitted back over the attacker's own TLS connection, giving a broad memory-disclosure primitive.\nI:H - The same premature free gives a write primitive \u2014 page-cache writeback and continued DMA/TLS use write into memory that has been reallocated to other kernel objects, which is the classic UAF heap-spray path to control-flow hijack. The tail page's raw `_refcount` is also left permanently corrupted.\nA:H - Refcount underflow on a live folio trips `VM_BUG_ON_FOLIO`/`bad_page()` and frees memory that is still in use, producing oopses, page-allocator corruption, and kernel panic; the attacker can repeat this at will over many connections."
    }
  }
}