PT-2024-35558 · Linux+5 · Linux Kernel+5
Published
2024-10-11
·
Updated
2026-05-26
·
CVE-2024-53094
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.65
Description
A vulnerability in the Linux kernel has been resolved by adding a sendpage ok() check to disable MSG SPLICE PAGES while running ISER over SIW. The initiator machine encounters a warning from skb splice from iter() indicating that a slab page is being used in send page. To address this, the sendpage ok() check is added within the driver itself, and if it returns 0, then the MSG SPLICE PAGES flag should be disabled before entering the network stack. A similar issue has been discussed for NVMe.
Recommendations
To resolve the issue, update to Linux kernel version 6.6.65 or later. As a temporary workaround, consider disabling the MSG SPLICE PAGES flag in the RDMA/siw driver until a patch is available. Restrict access to the vulnerable network stack to minimize the risk of exploitation. Avoid using the
send page function in the affected API endpoint until the issue is resolved.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu