{"id":"CVE-2024-53094","state":"PUBLISHED","title":"RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES\n\nWhile running ISER over SIW, the initiator machine encounters a warning\nfrom skb_splice_from_iter() indicating that a slab page is being used in\nsend_page. To address this, it is better to add a sendpage_ok() check\nwithin the driver itself, and if it returns 0, then MSG_SPLICE_PAGES flag\nshould be disabled before entering the network stack.\n\nA similar issue has been discussed for NVMe in this thread:\nhttps://lore.kernel.org/all/20240530142417.146696-1-ofir.gal@volumez.com/\n\n  WARNING: CPU: 0 PID: 5342 at net/core/skbuff.c:7140 skb_splice_from_iter+0x173/0x320\n  Call Trace:\n   tcp_sendmsg_locked+0x368/0xe40\n   siw_tx_hdt+0x695/0xa40 [siw]\n   siw_qp_sq_process+0x102/0xb00 [siw]\n   siw_sq_resume+0x39/0x110 [siw]\n   siw_run_sq+0x74/0x160 [siw]\n   kthread+0xd2/0x100\n   ret_from_fork+0x34/0x40\n   ret_from_fork_asm+0x1a/0x30","publishedAt":"2024-11-21T18:17:10.600Z","updatedAt":"2026-10-30T12:20:01.111Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be","status":"affected","lessThan":"d5a019e819a0f0457570416bb2eb5f3321f5be81","versionType":"git"},{"version":"0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be","status":"affected","lessThan":"3406bfc813a9bbd9c3055795e985f527b7852e8c","versionType":"git"},{"version":"0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be","status":"affected","lessThan":"bb5738957d92c8603a90c9664d34236641c221b2","versionType":"git"},{"version":"0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be","status":"affected","lessThan":"4e1e3dd88a4cedd5ccc1a3fc3d71e03b70a7a791","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/siw/siw_qp_tx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.3","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.62","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.9","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/siw/siw_qp_tx.c"]}],"references":["https://git.kernel.org/stable/c/d5a019e819a0f0457570416bb2eb5f3321f5be81","https://git.kernel.org/stable/c/3406bfc813a9bbd9c3055795e985f527b7852e8c","https://git.kernel.org/stable/c/bb5738957d92c8603a90c9664d34236641c221b2","https://git.kernel.org/stable/c/4e1e3dd88a4cedd5ccc1a3fc3d71e03b70a7a791"],"weaknesses":[],"ingestedAt":"2026-10-30T12:36:04.432Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/53xxx/CVE-2024-53094.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-53094","state":"PUBLISHED","datePublished":"2024-11-21T18:17:10.600Z","dateUpdated":"2026-10-30T12:20:01.111Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-11-19T17:17:24.982Z"},"containers":{"cna":{"title":"RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES\n\nWhile running ISER over SIW, the initiator machine encounters a warning\nfrom skb_splice_from_iter() indicating that a slab page is being used in\nsend_page. To address this, it is better to add a sendpage_ok() check\nwithin the driver itself, and if it returns 0, then MSG_SPLICE_PAGES flag\nshould be disabled before entering the network stack.\n\nA similar issue has been discussed for NVMe in this thread:\nhttps://lore.kernel.org/all/20240530142417.146696-1-ofir.gal@volumez.com/\n\n  WARNING: CPU: 0 PID: 5342 at net/core/skbuff.c:7140 skb_splice_from_iter+0x173/0x320\n  Call Trace:\n   tcp_sendmsg_locked+0x368/0xe40\n   siw_tx_hdt+0x695/0xa40 [siw]\n   siw_qp_sq_process+0x102/0xb00 [siw]\n   siw_sq_resume+0x39/0x110 [siw]\n   siw_run_sq+0x74/0x160 [siw]\n   kthread+0xd2/0x100\n   ret_from_fork+0x34/0x40\n   ret_from_fork_asm+0x1a/0x30"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be","status":"affected","lessThan":"d5a019e819a0f0457570416bb2eb5f3321f5be81","versionType":"git"},{"version":"0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be","status":"affected","lessThan":"3406bfc813a9bbd9c3055795e985f527b7852e8c","versionType":"git"},{"version":"0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be","status":"affected","lessThan":"bb5738957d92c8603a90c9664d34236641c221b2","versionType":"git"},{"version":"0e935ae6afcdbe6f0c0aa457ae57feccc63bb9be","status":"affected","lessThan":"4e1e3dd88a4cedd5ccc1a3fc3d71e03b70a7a791","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/siw/siw_qp_tx.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.3","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.62","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.9","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/infiniband/sw/siw/siw_qp_tx.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d5a019e819a0f0457570416bb2eb5f3321f5be81"},{"url":"https://git.kernel.org/stable/c/3406bfc813a9bbd9c3055795e985f527b7852e8c"},{"url":"https://git.kernel.org/stable/c/bb5738957d92c8603a90c9664d34236641c221b2"},{"url":"https://git.kernel.org/stable/c/4e1e3dd88a4cedd5ccc1a3fc3d71e03b70a7a791"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - siw is an RDMA-over-TCP transport, and the vulnerable transmit path is driven by remote input — `siw_init_rresp()` takes the read length, local address and stag directly from a peer's RDMA Read Request off the TCP stream, and any length ≥ PAGE_SIZE selects the `MSG_SPLICE_PAGES` zero-copy path. The reported failure also occurs in ordinary remote-peer-driven iSER-over-siw traffic.\nAC:L - No race or unpredictable state is involved; slab-backed kernel-ULP buffers are the normal case (the reporter hit it in routine ISER-over-SIW operation), and the peer simply issues a read/transfer of at least PAGE_SIZE against an advertised region. `zcopy_tx` is hardcoded true and READ_RESPONSE WQEs are always unsignalled, so the zero-copy path is taken deterministically.\nPR:N - iWARP/MPA has no in-kernel authentication, and the RX path processes an inbound RDMA Read Request and queues the READ_RESPONSE with `perms = 0` — no access-rights or credential check gates the vulnerable transmit path. A peer at the far end of the RDMA connection holds no privileges on the victim host.\nUI:N - Triggering requires only normal or attacker-generated RDMA traffic on an established connection; no action by a local user or administrator on the victim system is needed.\nS:U - The fault, the corrupted page references and the resulting crash all occur within the victim kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - Handing non-`sendpage_ok()` pages to the network stack is exactly the condition `sendpage_ok()` exists to prevent — TCP retains references to slab pages that the allocator may recycle, so retransmitted segments can leak recycled kernel slab contents to the remote peer, and the resulting refcount corruption is a memory-corruption class defect leverageable for disclosure.\nI:H - `get_page()`/`put_page()` on slab pages corrupts the page refcount and can release a page that is still in use (the \"delayed Oops\" documented in include/linux/net.h), a use-after-free-class primitive; data transmitted from buffers the ULP has already freed or reused also corrupts on-wire data and MPA CRCs.\nA:H - The bad page trips `WARN_ON_ONCE()` in `skb_splice_from_iter()`, which is a kernel panic on any system with `panic_on_warn=1`, and returns `-EIO`, which aborts the FPDU, drives the QP to error state and tears down the RDMA storage/NFS session — repeatably, at the remote peer's discretion."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:20:01.111Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.6.62"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.11.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.12"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-53094","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-10-01T20:11:21.053170Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T20:17:12.985Z"}}]}}}