CVE-2024-53138

What it actually does

The vulnerability causes incorrect page reference counting in the kTLS transmit path when handling large folios, resulting in excessive decrements during release and potential memory corruption or kernel instability.

Why it matters to the business

Systems running affected Linux kernels may experience crashes or denial of service when using kTLS with sendfile operations involving large folios from NFS, impacting service availability.

How an attack unfolds

An attacker with local access can trigger the bug by performing kTLS-accelerated transmissions using sendfile on files served via NFS with large folio support, leading to improper page refcount handling.

How to fix it

Update the Linux kernel to the fixed commit a0ddb20a748b122ea86003485f7992fa5e84cc95 or later versions.

How to confirm the fix worked

Verify the kernel version includes the fix and test kTLS operations with sendfile and large folios.

Typical attack path

1. Gain local access to the system
2. Configure or use kTLS with sendfile() on NFS-mounted files using large folios
3. Trigger the resync dump completion path in mlx5e kTLS TX handling

How to detect it

Look for kernel panic logs or page fault errors in dmesg related to mlx5e kTLS TX resync.

What your security team should do

• Prioritize kernel updates on systems using mlx5e and kTLS
• Monitor for kernel oops or crashes related to page handling
• Apply the fix from the stable Linux kernel repository