Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can cause availability impact on systems using the RDMA SIW driver, especially iSER over SIW. The flaw involves unsafe page handling in a network send path, leading to kernel warnings and potential service disruption. It is local, requires low privileges, and has no sourced evidence of active exploitation.
Executive priority
Handle in normal vulnerability maintenance unless your environment uses SIW/RDMA storage or high-availability Linux workloads. For those systems, prioritize patch validation because the stated impact is availability, not data theft or privilege escalation.
Technical view
RDMA/siw could pass pages to the TCP send path with MSG_SPLICE_PAGES without confirming sendpage_ok(). The kernel fix adds that check and disables MSG_SPLICE_PAGES when unsafe, avoiding the skb_splice_from_iter warning path. CVSS is 5.5 with local attack vector, low complexity, low privileges, and high availability impact.
Likely exposure
Exposure is most likely on Linux systems using the siw Soft-iWARP RDMA driver and iSER over SIW. Generic Linux hosts not using this RDMA path appear less likely to be exposed. The bundle lists affected Linux kernel versions including 5.3, 6.6.62, 6.11.9, and 6.12.
Exploitation context
The CVE is not in KEV, and the provided sources do not claim active exploitation or public weaponization. The CVSS vector indicates local access with low privileges and no user interaction. Treat it primarily as a targeted local denial-of-service risk on relevant RDMA deployments.
Researcher notes
Evidence is limited to the CVE record and Linux stable commits. No CWE, exploit claim, or detailed affected distro matrix is provided. The fix is defensive handling of MSG_SPLICE_PAGES based on sendpage_ok(), with observed warning traces in the siw transmit path.
Mitigation direction
- Update to a vendor kernel containing the referenced upstream stable fixes.
- Check your Linux distribution advisory for the backported CVE-2024-53094 package.
- Prioritize hosts using siw, Soft-iWARP, RDMA, or iSER over SIW.
- If patching is delayed, review vendor guidance for reducing SIW/RDMA exposure.
Validation and detection
- Inventory kernels and map installed packages to CVE-2024-53094 vendor advisories.
- Confirm whether the siw RDMA driver or iSER over SIW is in use.
- Verify the kernel includes one of the referenced stable commits or a distro backport.
- Review kernel logs for warnings involving skb_splice_from_iter or siw_tx_hdt.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-53094 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3406bfc813a9bbd9c3055795e985f527b7852e8cCVE reference, Linux
- https://git.kernel.org/stable/c/bb5738957d92c8603a90c9664d34236641c221b2CVE reference, Linux
- https://git.kernel.org/stable/c/4e1e3dd88a4cedd5ccc1a3fc3d71e03b70a7a791CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.