Linux kernel mlx5_core kTLS TX offload: The kTLS TX path mixes get_page() and page_ref_inc() when acquiring references

Impact

The kTLS TX path mixes get_page() and page_ref_inc() when acquiring references but only put_page() when releasing. With large folios the page is dereferenced too many times, producing a use-after-free. Found in the wild via sendfile() with zero-copy over NFS. Any node terminating TLS in hardware on ConnectX is exposed - storage gateways and object-store frontends in a GPU cloud typically are.

Who can reach it

Remote, unauthenticated, over a TLS connection served by mlx5 hardware kTLS TX offload with large-folio pages in play.

What to do

Upgrade the host kernel to 6.12 or one of the many stable backports (5.4.287, 5.10.231, 5.15.174, 6.1.119, 6.6.63, 6.11.10) - the wide backport range means most distros already ship a fix. Rolling reboot. Interim: disable kTLS TX offload on mlx5 interfaces (ethtool -K <dev> tls-hw-tx-offload off), a live config change at a CPU cost.

References