Linux kernel mlx5_core kTLS TX offload: The kTLS TX path mixes get_page() and page_ref_inc() when acquiring references

Impact

The kTLS TX path mixes get_page() and page_ref_inc() when acquiring references but only put_page() when releasing. With large folios the page is dereferenced too many times, producing a use-after-free. Found in the wild via sendfile() with zero-copy over NFS. Any node terminating TLS in hardware on ConnectX is exposed - storage gateways and object-store frontends in a GPU cloud typically are.

Who can reach it

Remote, unauthenticated, over a TLS connection served by mlx5 hardware kTLS TX offload with large-folio pages in play.

What to do

Upgrade the host kernel to 6.12 or one of the many stable backports (5.4.287, 5.10.231, 5.15.174, 6.1.119, 6.6.63, 6.11.10) - the wide backport range means most distros already ship a fix. Rolling reboot. Interim: disable kTLS TX offload on mlx5 interfaces (ethtool -K <dev> tls-hw-tx-offload off), a live config change at a CPU cost.

References

Related entries

• Linux kernel (net/smc): The server-side listen worker frees a connection outside the socket lock, so smc_conn_free()CVE-2024-56640 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): A link-down work item can be queued before the link group is freed but run after, so the workerCVE-2024-56718 · Linux kernel (net/smc)Critical
• Linux kernel (net/tls): The synchronous decrypt path shared refcounting and completion state with the async path, so aCVE-2024-58240 · Linux kernel (net/tls)Critical
• Linux kernel (drivers/nvme/target): The target disables a namespace without waiting for in-flight I/O to drain, so aCVE-2025-21850 · Linux kernel (drivers/nvme/target)Critical
• Linux kernel - NVMe/TCP host (initiator), drivers/nvme/host/tcp.c: Nvme_tcp_recv_pdu() did not validate the PDU headerCVE-2025-21927 · Linux kernel - NVMe/TCP host (initiator), drivers/nvme/host/tcp.cCritical
• Linux kernel (net/tls): The strparser kept a stale reference to an skb that TCP had already coalesced away, and theCVE-2025-38471 · Linux kernel (net/tls)Critical