{"id":"CVE-2024-53219","revision":null,"records":[{"revision":"bd4590e5fb074d60bf7707578168a2f9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-53219","aliases":[],"title":"virtiofs: use pages instead of pointer for kernel direct IO","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: use pages instead of pointer for kernel direct IO\n\nWhen trying to insert a 10MB kernel module kept in a virtio-fs with cache\ndisabled, the following warning was reported:\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ......\n  Modules linked in:\n  CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n  RIP: 0010:__alloc_pages+0x2bf/0x380\n  ......\n  Call Trace:\n   <TASK>\n   ? __warn+0x8e/0x150\n   ? __alloc_pages+0x2bf/0x380\n   __kmalloc_large_node+0x86/0x160\n   __kmalloc+0x33c/0x480\n   virtio_fs_enqueue_req+0x240/0x6d0\n   virtio_fs_wake_pending_and_unlock+0x7f/0x190\n   queue_request_and_unlock+0x55/0x60\n   fuse_simple_request+0x152/0x2b0\n   fuse_direct_io+0x5d2/0x8c0\n   fuse_file_read_iter+0x121/0x160\n   __kernel_read+0x151/0x2d0\n   kernel_read+0x45/0x50\n   kernel_read_file+0x1a9/0x2a0\n   init_module_from_file+0x6a/0xe0\n   idempotent_init_module+0x175/0x230\n   __x64_sys_finit_module+0x5d/0xb0\n   x64_sys_call+0x1c3/0x9e0\n   do_syscall_64+0x3d/0xc0\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n   ......\n   </TASK>\n  ---[ end trace 0000000000000000 ]---\n\nThe warning is triggered as follows:\n\n1) syscall finit_module() handles the module insertion and it invokes\nkernel_read_file() to read the content of the module first.\n\n2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and\npasses it to kernel_read(). kernel_read() constructs a kvec iter by\nusing iov_iter_kvec() and passes it to fuse_file_read_iter().\n\n3) virtio-fs disables the cache, so fuse_file_read_iter() invokes\nfuse_direct_io(). As for now, the maximal read size for kvec iter is\nonly limited by fc->max_read. For virtio-fs, max_read is UINT_MAX, so\nfuse_direct_io() doesn't split the 10MB buffer. It saves the address and\nthe size of the 10MB-sized buffer in out_args[0] of a fuse request and\npasses the fuse request to virtio_fs_wake_pending_and_unlock().\n\n4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to\nqueue the request. Because virtiofs need DMA-able address, so\nvirtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for\nall fuse args, copies these args into the bounce buffer and passed the\nphysical address of the bounce buffer to virtiofsd. The total length of\nthese fuse args for the passed fuse request is about 10MB, so\ncopy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and\nit triggers the warning in __alloc_pages():\n\n\tif (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp))\n\t\treturn NULL;\n\n5) virtio_fs_enqueue_req() will retry the memory allocation in a\nkworker, but it won't help, because kmalloc() will always return NULL\ndue to the abnormal size and finit_module() will hang forever.\n\nA feasible solution is to limit the value of max_read for virtio-fs, so\nthe length passed to kmalloc() will be limited. However it will affect\nthe maximal read size for normal read. And for virtio-fs write initiated\nfrom kernel, it has the similar problem but now there is no way to limit\nfc->max_write in kernel.\n\nSo instead of limiting both the values of max_read and max_write in\nkernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as\ntrue in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use\npages instead of pointer to pass the KVEC_IO data.\n\nAfter switching to pages for KVEC_IO data, these pages will be used for\nDMA through virtio-fs. If these pages are backed by vmalloc(),\n{flush|invalidate}_kernel_vmap_range() are necessary to flush or\ninvalidate the cache before the DMA operation. So add two new fields in\nfuse_args_pages to record the base address of vmalloc area and the\ncondition indicating whether invalidation is needed. Perform the flush\nin fuse_get_user_pages() for write operations and the invalidation in\nfuse_release_user_pages() for read operations.\n\nIt may seem necessary to introduce another fie\n---truncated---","state":0,"publishedAt":"2024-12-27T13:50:04.55+00:00","modifiedAt":"2026-10-21T12:35:36.199+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/fuse/file.c\",\n                        \"fs/fuse/fuse_i.h\",\n                        \"fs/fuse/virtio_fs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a62a8ef9d97da23762a588592c8b8eb50a8deb6a\",\n                            \"lessThan\": \"0015d54a47995867781224450525e60a1a0077ab\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a62a8ef9d97da23762a588592c8b8eb50a8deb6a\",\n                            \"lessThan\": \"9a8fde56d4b6d51930936ed50f6370a9097328d1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a62a8ef9d97da23762a588592c8b8eb50a8deb6a\",\n                            \"lessThan\": \"2bc07714dc955a91d2923a440ea02c3cb3376b10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a62a8ef9d97da23762a588592c8b8eb50a8deb6a\",\n                            \"lessThan\": \"41748675c0bf252b3c5f600a95830f0936d366c1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/fuse/file.c\",\n                        \"fs/fuse/fuse_i.h\",\n                        \"fs/fuse/virtio_fs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11.11\",\n                            \"lessThanOrEqual\": \"6.11.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.2\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.13\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/0015d54a47995867781224450525e60a1a0077ab","https://git.kernel.org/stable/c/9a8fde56d4b6d51930936ed50f6370a9097328d1","https://git.kernel.org/stable/c/2bc07714dc955a91d2923a440ea02c3cb3376b10","https://git.kernel.org/stable/c/41748675c0bf252b3c5f600a95830f0936d366c1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-53219","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-53219","identifiers":["CVE-2024-53219"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T11:07:12.3917769+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T11:07:12.3917769+00:00","lastSuccessAt":"2026-11-08T11:07:12.6245628+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:07:12.6245643+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-e58a079eb6f76d5949b871c295ad9e8f78e928765ff9950581a38d46375b9852","complete":true,"records":421096,"lastAttemptAt":"2026-11-08T11:04:36.6753622+00:00","lastSuccessAt":"2026-11-08T07:59:14.3145447+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-08T07:59:14.338564+00:00","snapshotPublishedAt":"2026-11-08T07:27:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-86f25219fb644e6286aef55d85e25bf2","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T11:08:04.0096912+00:00","lastSuccessAt":"2026-11-08T11:08:04.005+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:08:04.005+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T11:07:12.3917769+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T11:07:12.3917769+00:00","lastSuccessAt":"2026-11-08T11:07:12.625607+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:07:12.6256073+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d989edc1cedd4bc98ff58bba187706b1","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T11:07:38.8809876+00:00","lastSuccessAt":"2026-11-08T11:07:38.877+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:07:38.877+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T11:07:07.3505725+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:07:07.3505725+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T11:04:36.8284473+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:04:36.8284473+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T11:07:12.3467238+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:07:12.3467238+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T11:06:57.8078151+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T11:06:57.8078151+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}