Executive brief
A use-after-free vulnerability in the Linux kernel's SMB client DFS (Distributed File System) session handling code could allow an attacker with network access to a compromised SMB server to trigger a kernel crash or potentially execute arbitrary code. The bug affects systems using SMB/CIFS mounts with DFS redirection, which are commonly used in enterprise environments for file sharing and access.
Technical details
The vulnerability is a use-after-free in the CIFS/SMB client DFS connection sharing logic (fs/smb/client/dfs.c). The root cause is improper reference counting of SMB session objects (@ses and @ses->dfs_root_ses). When a DFS mount is performed, the code failed to properly increment the reference count of session objects, allowing a session to be freed prematurely via cifs_put_smb_ses() while still being referenced elsewhere. An attacker controlling an SMB server or performing a man-in-the-middle attack on SMB traffic could trigger this by inducing specific DFS referral scenarios. The fix uses a new cifs_smb_ses_inc_refcount() helper function to ensure proper reference counting. The vulnerability requires network access to an SMB server and is triggered through normal DFS mount operations.
Affected products
- Linux Linux kernel Affected versions across stable kernel branches; patch applied 2023-07-11
Timeline
- 2025-12-24: disclosed
- 2023-07-11: patched: Patch committed by Paulo Alcantara, merged in stable branches starting 2023-07-27