---
id: CVE-2024-53138
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: kTLS, Fix incorrect page refcounting

  The kTLS tx handling code is using a mix of get_page() and
  page_ref_inc() APIs to increment the page reference
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: kTLS, Fix incorrect page refcounting

  The kTLS tx handling code is using a mix of get_page() and
  page_ref_inc() APIs to increment the page reference. But on …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.4, < 6.1.119'
  - 'linux_kernel >= 6.2, < 6.6.63'
  - 'linux_kernel >= 6.7, < 6.11.10'
  - linux_kernel = 6.12
patched:
  - linux_kernel 6.11.10
published: '2024-12-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:00.253'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-53138'
references:
  - url: 'https://git.kernel.org/stable/c/2723e8b2cbd486cb96e5a61b22473f7fd62e18df'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/69fbd07f17b0fdaf8970bc705f5bf115c297839d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/93a14620b97c911489a5b008782f3d9b0c4aeff4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a0ddb20a748b122ea86003485f7992fa5e84cc95'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c7b97f9e794d8e2bbaa50e1d6c230196fd214b5e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dd6e972cc5890d91d6749bb48e3912721c4e4b25'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ffad2ac8c859c1c1a981fe9c4f7ff925db684a43'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00546
epssPercentile: 0.45595
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-15T21:40:46.946436Z'
ingestedAt: '2026-10-15T22:48:25.443Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: kTLS, Fix incorrect page refcounting

The kTLS tx handling code is using a mix of get_page() and
page_ref_inc() APIs to increment the page reference. But on the release
path (mlx5e_ktls_tx_handle_resync_dump_comp()), only put_page() is used.

This is an issue when using pages from large folios: the get_page()
references are stored on the folio page while the page_ref_inc()
references are stored directly in the given page. On release the folio
page will be dereferenced too many times.

This was found while doing kTLS testing with sendfile() + ZC when the
served file was read from NFS on a kernel with NFS large folios support
(commit 49b29a573da8 ("nfs: add support for large folios")).

## Affected

- `linux_kernel >= 5.4, < 6.1.119`
- `linux_kernel >= 6.2, < 6.6.63`
- `linux_kernel >= 6.7, < 6.11.10`
- `linux_kernel = 6.12`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.11.10`