Critical 9.8Published Dec 4, 2024

CVE-2024-53138net/mlx5e: kTLS, Fix incorrect page refcounting

Updated under an hour ago (Oct 26, 2026, 6:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix incorrect page refcounting The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used. This is an issue when using pages from large folios: the get_page() references are stored on the folio page while the page_ref_inc() references are stored directly in the given page. On release the folio page will be dereferenced too many times. This was found while doing kTLS testing with sendfile() + ZC when the served file was read from NFS on a kernel with NFS large folios support (commit 49b29a573da8 ("nfs: add support for large folios")).

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 84d1bb2b139e0184b1754aa1b5776186b475fce8 before a0ddb20a748b122ea86003485f7992fa5e84cc95; from 84d1bb2b139e0184b1754aa1b5776186b475fce8 before ffad2ac8c859c1c1a981fe9c4f7ff925db684a43; from 84d1bb2b139e0184b1754aa1b5776186b475fce8 before c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e; 84d1bb2b139e0184b1754aa1b5776186b475fce8 builds before 69fbd07f17b0fdaf8970bc705f5bf115c297839d; from 84d1bb2b139e0184b1754aa1b5776186b475fce8 before 93a14620b97c911489a5b008782f3d9b0c4aeff4; from 84d1bb2b139e0184b1754aa1b5776186b475fce8 before 2723e8b2cbd486cb96e5a61b22473f7fd62e18df; from 84d1bb2b139e0184b1754aa1b5776186b475fce8 before dd6e972cc5890d91d6749bb48e3912721c4e4b25	CNA record
linux linux_kernel linux:linux_kernel	from 5.4 before 6.1.119; from 6.2 before 6.6.63; from 6.7 before 6.11.10; 6.12; 6.12; 6.12; 6.12; 6.12; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/a0ddb20a748b122ea86003485f7992fa5e84cc95
https://git.kernel.org/stable/c/ffad2ac8c859c1c1a981fe9c4f7ff925db684a43
https://git.kernel.org/stable/c/c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e
https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d	patch
https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4	patch
https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df	patch
https://git.kernel.org/stable/c/dd6e972cc5890d91d6749bb48e3912721c4e4b25	patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.