Junglewise Threat Intelligence

CVE-2023-53794: Linux kernel CIFS use-after-free in session reconnect

CVE-2023-53794 · Severity: critical · CVSS 9.8 · Published 2025-12-09

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's CIFS (Common Internet File System) implementation handles file sharing and network connectivity for SMB/CIFS servers. A use-after-free vulnerability in the session reconnect logic could allow an attacker to crash the system or potentially execute code by manipulating session state during reconnection attempts.

Technical details

This is a use-after-free vulnerability in the smb2_reconnect_server() function within fs/smb/client/smb2pdu.c. The vulnerable code was collecting exiting sessions during reconnection without checking their state; these sessions could be freed while still being referenced, leading to potential code execution or denial of service. The fix adds a session state check (SES_EXITING) under ses_lock protection to skip exiting sessions that will soon be released via cifs_free_ipc() and logoff(). The vulnerability affects the kernel's SMB/CIFS client implementation and requires a local or network-based trigger during active reconnection scenarios.

Affected products

  • Linux Linux kernel Multiple versions prior to fix commit 99f280700b4cc02d5f141b8d15f8e9fad0418f65

Timeline

  • 2023-06-26: disclosed
  • 2023-08-23: patched

References

Related threats