Executive brief
The Linux kernel's CIFS (Common Internet File System) module contains a race condition in the oplock break handling code that can cause a kernel crash. When a network file system unmount occurs while the oplock break handler is running, a null pointer dereference leads to a kernel panic, disrupting file system access and potentially causing data loss or system instability.
Technical details
The vulnerability is a race condition in the cifs_oplock_break function where deferred closes can race with lease breaks. An unmount (kill_sb) can occur between validity checks of tcon->ses, leading to a null pointer dereference when attempting to access memory at offset 0x60 in the invalidated session structure. The attack vector requires local access to trigger unmount operations concurrent with active CIFS lease break processing. The fix reorders validation checks to verify the openFileList is empty before sending the oplock response, eliminating the race window.
Affected products
- Linux Linux kernel Affected versions through patch release (CVE-2023-54258)
Timeline
- 2025-12-30: disclosed: CVE-2023-54258 published
- patched: Fix available: reorder checks in cifs_oplock_break to validate openFileList before oplock response