{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54162", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T13:02:52.531Z", "datePublished": "2025-12-30T12:03:23.583Z", "dateUpdated": "2026-08-05T09:17:44.673Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:44.673Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix possible memory leak in smb2_lock()\n\nargv needs to be free when setup_async_work fails or when the current\nprocess is woken up." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - smb2_lock()/smb2_cancel() are ksmbd SMB2 command handlers reached directly from remote packets on TCP/445, with no local access required. The entire race is driven by SMB2_LOCK, SMB2_CANCEL and SMB2_CLOSE PDUs sent by a remote client.\nAC:L - The attacker controls both sides of every race — it issues the blocking SMB2_LOCK, then pipelines SMB2_CANCEL/SMB2_CLOSE, which ksmbd dispatches as concurrent workqueue items on the same connection, and can repeat indefinitely across many connections. The argv leak itself is deterministic on every cancelled or woken deferred lock.\nPR:L - SMB2_LOCK requires an established session, tree connect and an open file handle, so a low-privileged authenticated SMB user (or a guest-mapped account on typical NAS/embedded configs) suffices; no administrative rights are needed. Upstream reproduced the sibling bugs on this same path \"by an authenticated SMB client\".\nUI:N - The attacker drives the whole sequence from its own SMB connection; no action by any local user or administrator is needed. The contending lock, the cancel and the close are all attacker-initiated.\nS:U - The corruption and resource exhaustion stay within the kernel's own security authority on the SMB server host. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The stale cancel_fn/cancel_argv leave a use-after-free on a freed struct file_lock (192-byte file_lock_cache, easily sprayed by an attacker holding many byte-range locks) and on the freed ksmbd_work, giving read access to reallocated kernel heap contents. UAF of this kind is treated as High confidentiality impact.\nI:H - The UAF is exercised through an indirect call — smb2_cancel() invokes cancel_fn from a freed ksmbd_work, and smb2_remove_blocked_lock()'s wake_up() walks a freed waitqueue calling curr->func() — providing a control-flow hijack / arbitrary-write primitive once the slab is reclaimed with attacker-shaped data.\nA:H - The double list_del of work->fp_entry writes through LIST_POISON and oopses a kworker while it holds fp->f_lock, permanently wedging that spinlock; the file_lock UAF crashes the kernel outright, and the unbounded argv leak drives the server to memory exhaustion. All are remotely repeatable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ksmbd/smb2pdu.c", "fs/ksmbd/vfs_cache.c" ], "versions": [ { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "bfe8372ef2dbdce97f13b21d76e2080ddeef5a79", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "6bf555ed8938444466c3d7f3252eb874a518f293", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "11d38f8a0c19763e34d2093b5ecb640e012cb2d2", "status": "affected", "versionType": "git" }, { "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "d3ca9f7aeba793d74361d88a8800b2f205c9236b", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/ksmbd/smb2pdu.c", "fs/ksmbd/vfs_cache.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.145", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.16", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2.3", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.145" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.2.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/bfe8372ef2dbdce97f13b21d76e2080ddeef5a79" }, { "url": "https://git.kernel.org/stable/c/6bf555ed8938444466c3d7f3252eb874a518f293" }, { "url": "https://git.kernel.org/stable/c/11d38f8a0c19763e34d2093b5ecb640e012cb2d2" }, { "url": "https://git.kernel.org/stable/c/d3ca9f7aeba793d74361d88a8800b2f205c9236b" } ], "title": "ksmbd: fix possible memory leak in smb2_lock()", "x_generator": { "engine": "bippy-1.2.0" } } } }