CVE-2024-53219 — virtiofs: use pages instead of pointer for kernel direct IO
In the Linux kernel, the following vulnerability has been resolved: virtiofs: use pages instead of pointer for kernel direct IO When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ...... Modules linked in: CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:__alloc_pages+0x2bf/0x380 ...... Call Trace: <TASK> ? __warn+0x8e/0x150 ? __alloc_pages+0x2bf/0x380 __kmalloc_large_node+0x86/0x160 __kmalloc+0x33c/0x480 virtio_fs_enqueue_req+0x240/0x6d0 virtio_fs_wake_pending_and_unlock+0x7f/0x190 queue_request_and_unlock+0x55/0x60 fuse_simple_request+0x152/0x2b0 fuse_direct_io+0x5d2/0x8c0 fuse_file_read_iter+0x121/0x160 __kernel_read+0x151/0x2d0 kernel_read+0x45/0x50 kernel_read_file+0x1a9/0x2a0 init_module_from_file+0x6a/0xe0 idempotent_init_module+0x175/0x230 __x64_sys_finit_module+0x5d/0xb0 x64_sys_call+0x1c3/0x9e0 do_syscall_64+0x3d/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ...... </TASK> ---[ end trace 0000000000000000 ]--- The warning is triggered as follows: 1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first. 2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter(). 3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc->max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn't split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock(). 4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in __alloc_pages(): if (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)) return NULL; 5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won't help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever. A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc->max_write in kernel. So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data. After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations. It may seem necessary to introduce another fie ---truncated---
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
How the score was calculated
- EPSS 0.3% (30-day exploitation probability)+3
- Technical severity (medium)+3
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
CISA SSVC assessment CISA
Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
- Documented patch — git.kernel.org (NIST National Vulnerability Database)
- Documented patch — git.kernel.org (NIST National Vulnerability Database)
- Documented patch — git.kernel.org (NIST National Vulnerability Database)
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Linux Linux, Linux Linux Kernel).
- Apply the fixed version or the patch documented under Remediation.
- Search available logs for exploit probes, errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Linux | Linux | ≥ a62a8ef9d97da23762a588592c8b8eb50a8deb6a and < 0015d54a47995867781224450525e60a1a0077ab≥ a62a8ef9d97da23762a588592c8b8eb50a8deb6a and < 9a8fde56d4b6d51930936ed50f6370a9097328d1≥ a62a8ef9d97da23762a588592c8b8eb50a8deb6a and < 2bc07714dc955a91d2923a440ea02c3cb3376b10≥ a62a8ef9d97da23762a588592c8b8eb50a8deb6a and < 41748675c0bf252b3c5f600a95830f0936d366c1version 5.4 | Vulnerable | CVE Program (cve.org) e CISA ADP |
| Linux | Linux Kernel | ≥ 5.4 and < 6.11.11≥ 6.12 and < 6.12.2 | Vulnerable | NIST National Vulnerability Database |
Attack characteristics
The CVSS vector, decoded. It describes the attack, not your exposure to it.
Every base score collected
Sources score independently and may disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Scored by |
|---|---|---|---|---|---|
| 5.5 | CVSS 3.1 | Medium | 1.8 | 3.6 | nvd@nist.gov via NIST National Vulnerability Database |
| 5.5 | CVSS 3.1 | Medium | 1.8 | 3.6 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 via NIST National Vulnerability Database |
| 5.5 | CVSS 3.1 | Medium | — | — | GitHub, Inc. via GitHub Security Advisories |
| 5.5 | CVSS 3.1 | Medium | — | — | CISA-ADP via CVE Program (cve.org) e CISA ADP |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (score shown at the top: nvd@nist.gov) EPSS over time FIRST
Oct 20, 2026 → Oct 28, 2026 · 9 reading(s) · max 0.27%
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Local/physical vector: focus on endpoint telemetry (EDR) from affected hosts.
Timeline
What happened to this CVE, newest first.
- 2026
- Affected products added · linux/linux
- SSVC assessment updated
- Record published
- Fix documented
- Affected products added · linux/linux kernel
- CVSS changed · 5.5
- Source status changed · → Modified
- Record created in this database
- 2024
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 2× References added · Oct 21, 2026 – Oct 21, 2026
- 1× Official description updated · Oct 21, 2026 – Oct 21, 2026
References
6 on the record
- git.kernel.org/stable/c/2bc07714dc955a91d2923a440ea02c3cb3376b10
- git.kernel.org/stable/c/9a8fde56d4b6d51930936ed50f6370a9097328d1
- git.kernel.org/stable/c/41748675c0bf252b3c5f600a95830f0936d366c1
- nvd.nist.gov/vuln/detail/CVE-2024-53219
- git.kernel.org/stable/c/0015d54a47995867781224450525e60a1a0077ab
- github.com/advisories/GHSA-8r65-896m-pfq8
Elsewhere on this site
Related CVEs (same products)
- Unknown CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths 1d
- Unknown CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs 1d
- Unknown CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock 1d
- Unknown CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation 1d
- Unknown CVE-2026-99209 drm/xe: skip eviction of a BO with no resource 1d
- Unknown CVE-2026-99210 accel/rocket: clear rdev on device init failure 1d
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No CWE classification.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2024-53219 is "virtiofs: use pages instead of pointer for kernel direct IO", rated Medium. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 5.5 describes technical severity. EPSS 0.27% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.