{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-53990", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:53:46.175Z", "datePublished": "2025-12-24T10:55:29.156Z", "dateUpdated": "2026-08-05T09:16:31.988Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:16:31.988Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSMB3: Add missing locks to protect deferred close file list\n\ncifs_del_deferred_close function has a critical section which modifies\nthe deferred close file list. We must acquire deferred_lock before\ncalling cifs_del_deferred_close function." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - This is the SMB client (fs/cifs/), and the race is driven by local syscalls — open(2)/close(2) racing against unlink(2)/rename(2) on a mounted CIFS/SMB3 share. No network peer input is needed to trigger the unlocked list manipulation.\nAC:L - The attacker controls both sides of the race entirely, spawning one thread looping open/close and another looping rename/unlink on the same share, and can retry indefinitely. The only precondition — an RHW lease enabling deferred closes — is the default behavior of Samba/Windows servers and can be guaranteed by pointing the mount at an attacker-controlled server.\nPR:L - Only an unprivileged local user with access to an already-mounted CIFS share is needed; cifs_unlink(), cifs_rename2(), cifs_open() and cifs_close() perform no capability checks on the path to cifs_del_deferred_close(). The mount itself is a normal environmental condition in enterprise, container, and desktop deployments.\nUI:N - The attacker performs all the racing file operations itself with no victim involvement; the presence of the mount is an environmental precondition rather than an action the exploit must induce a user to take.\nS:U - The corruption is confined to kernel slab memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Unsynchronized list_del plus kfree of struct cifs_deferred_close against concurrent list_add/list_del yields a double-free and use-after-free on a shared kmalloc-64 slab, and cifs_is_deferred_close() walks the list while it is being freed, giving an attacker who reclaims the object an arbitrary kernel-memory read primitive.\nI:H - The double-free of a 48-byte object in a general-purpose slab cache is a classic heap-spray primitive allowing the attacker to reclaim the chunk with an attacker-controlled structure and obtain an arbitrary write, and the corrupted list_head permits controlled writes via subsequent list_del operations.\nA:H - Even without full exploitation, concurrent list_del on the deferred_closes list corrupts list pointers and double-frees memory, producing list_del corruption BUG()s, KASAN splats, and kernel panics that are repeatedly triggerable by any local user with share access." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/cifs/misc.c" ], "versions": [ { "version": "860efae127888ae535bc4eda1b7f27642727c69e", "lessThan": "0f87e18203bd30f71eb1a65259e28e291b6cc43a", "status": "affected", "versionType": "git" }, { "version": "ca08d0eac020d48a3141dbec0a3cf64fbdb17cde", "lessThan": "3aa9d065b0685b4e6052f3f2a2462966fdc44fd2", "status": "affected", "versionType": "git" }, { "version": "ca08d0eac020d48a3141dbec0a3cf64fbdb17cde", "lessThan": "cb36365dac25d546ca4af0eb22acb43c9b4ddfdf", "status": "affected", "versionType": "git" }, { "version": "ca08d0eac020d48a3141dbec0a3cf64fbdb17cde", "lessThan": "32a046ccaeea6c19965c04a4c521e703f6607924", "status": "affected", "versionType": "git" }, { "version": "ca08d0eac020d48a3141dbec0a3cf64fbdb17cde", "lessThan": "ab9ddc87a9055c4bebd6524d5d761d605d52e557", "status": "affected", "versionType": "git" }, { "version": "60b6d38add7b9c17d6e5d49ee8e930ea1a5650c5", "status": "affected", "versionType": "git" }, { "version": "5.15.63", "lessThan": "5.15.111", "status": "affected", "versionType": "semver" }, { "version": "5.19.4", "lessThan": "5.20", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/cifs/misc.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.111", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.28", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2.15", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.2", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.63", "versionEndExcluding": "5.15.111" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.28" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.2.15" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.3.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0f87e18203bd30f71eb1a65259e28e291b6cc43a" }, { "url": "https://git.kernel.org/stable/c/3aa9d065b0685b4e6052f3f2a2462966fdc44fd2" }, { "url": "https://git.kernel.org/stable/c/cb36365dac25d546ca4af0eb22acb43c9b4ddfdf" }, { "url": "https://git.kernel.org/stable/c/32a046ccaeea6c19965c04a4c521e703f6607924" }, { "url": "https://git.kernel.org/stable/c/ab9ddc87a9055c4bebd6524d5d761d605d52e557" } ], "title": "SMB3: Add missing locks to protect deferred close file list", "x_generator": { "engine": "bippy-1.2.0" } } } }