CVE-2024-53138
A critical bug in the Linux kernel’s kTLS handling code could cause incorrect page reference counting, potentially leading to memory corruption. The issue arises when sending files over NFS with large folios support. It has been fixed in the kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel 6.12 and earlier versions that include the kTLS code; users running those kernels on systems that use NFS with large folios support.
Real-world impact
An attacker could cause memory corruption or a crash, potentially leading to denial of service or arbitrary code execution.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, with no authentication or user interaction required.
What to do about it
- 01Upgrade to a Linux kernel version that includes the fix (e.g., a newer release than 6.12).
NVD description indicates the vulnerability has been resolved.
Timeline
- Dec 4, 2024 · Dec 4, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/2723e8b2cbd486cb96…patch
- git.kernel.org/stable/c/69fbd07f17b0fdaf89…patch
- git.kernel.org/stable/c/93a14620b97c911489…patch
- git.kernel.org/stable/c/a0ddb20a748b122ea8…
- git.kernel.org/stable/c/c7b97f9e794d8e2bba…
- git.kernel.org/stable/c/dd6e972cc5890d91d6…patch
- git.kernel.org/stable/c/ffad2ac8c859c1c1a9…
- lists.debian.org/debian-lts-announce/2025/01…
- lists.debian.org/debian-lts-announce/2025/03…