{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53990","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-12-24T10:53:46.175Z","datePublished":"2025-12-24T10:55:29.156Z","dateUpdated":"2026-08-05T09:16:31.988Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:16:31.988Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nSMB3: Add missing locks to protect deferred close file list\n\ncifs_del_deferred_close function has a critical section which modifies\nthe deferred close file list. We must acquire deferred_lock before\ncalling cifs_del_deferred_close function."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - This is the SMB client (fs/cifs/), and the race is driven by local syscalls — open(2)/close(2) racing against unlink(2)/rename(2) on a mounted CIFS/SMB3 share. No network peer input is needed to trigger the unlocked list manipulation.\nAC:L - The attacker controls both sides of the race entirely, spawning one thread looping open/close and another looping rename/unlink on the same share, and can retry indefinitely. The only precondition — an RHW lease enabling deferred closes — is the default behavior of Samba/Windows servers and can be guaranteed by pointing the mount at an attacker-controlled server.\nPR:L - Only an unprivileged local user with access to an already-mounted CIFS share is needed; cifs_unlink(), cifs_rename2(), cifs_open() and cifs_close() perform no capability checks on the path to cifs_del_deferred_close(). The mount itself is a normal environmental condition in enterprise, container, and desktop deployments.\nUI:N - The attacker performs all the racing file operations itself with no victim involvement; the presence of the mount is an environmental precondition rather than an action the exploit must induce a user to take.\nS:U - The corruption is confined to kernel slab memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Unsynchronized list_del plus kfree of struct cifs_deferred_close against concurrent list_add/list_del yields a double-free and use-after-free on a shared kmalloc-64 slab, and cifs_is_deferred_close() walks the list while it is being freed, giving an attacker who reclaims the object an arbitrary kernel-memory read primitive.\nI:H - The double-free of a 48-byte object in a general-purpose slab cache is a classic heap-spray primitive allowing the attacker to reclaim the chunk with an attacker-controlled structure and obtain an arbitrary write, and the corrupted list_head permits controlled writes via subsequent list_del operations.\nA:H - Even without full exploitation, concurrent list_del on the deferred_closes list corrupts list pointers and double-frees memory, producing list_del corruption BUG()s, KASAN splats, and kernel panics that are repeatedly triggerable by any local user with share access."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/misc.c"],"versions":[{"version":"860efae127888ae535bc4eda1b7f27642727c69e","lessThan":"0f87e18203bd30f71eb1a65259e28e291b6cc43a","status":"affected","versionType":"git"},{"version":"ca08d0eac020d48a3141dbec0a3cf64fbdb17cde","lessThan":"3aa9d065b0685b4e6052f3f2a2462966fdc44fd2","status":"affected","versionType":"git"},{"version":"ca08d0eac020d48a3141dbec0a3cf64fbdb17cde","lessThan":"cb36365dac25d546ca4af0eb22acb43c9b4ddfdf","status":"affected","versionType":"git"},{"version":"ca08d0eac020d48a3141dbec0a3cf64fbdb17cde","lessThan":"32a046ccaeea6c19965c04a4c521e703f6607924","status":"affected","versionType":"git"},{"version":"ca08d0eac020d48a3141dbec0a3cf64fbdb17cde","lessThan":"ab9ddc87a9055c4bebd6524d5d761d605d52e557","status":"affected","versionType":"git"},{"version":"60b6d38add7b9c17d6e5d49ee8e930ea1a5650c5","status":"affected","versionType":"git"},{"version":"5.15.63","lessThan":"5.15.111","status":"affected","versionType":"semver"},{"version":"5.19.4","lessThan":"5.20","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/cifs/misc.c"],"versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","status":"unaffected","versionType":"semver"},{"version":"5.15.111","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.28","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2.15","lessThanOrEqual":"6.2.*","status":"unaffected","versionType":"semver"},{"version":"6.3.2","lessThanOrEqual":"6.3.*","status":"unaffected","versionType":"semver"},{"version":"6.4","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.63","versionEndExcluding":"5.15.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.28"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.2.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.3.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19.4"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0f87e18203bd30f71eb1a65259e28e291b6cc43a"},{"url":"https://git.kernel.org/stable/c/3aa9d065b0685b4e6052f3f2a2462966fdc44fd2"},{"url":"https://git.kernel.org/stable/c/cb36365dac25d546ca4af0eb22acb43c9b4ddfdf"},{"url":"https://git.kernel.org/stable/c/32a046ccaeea6c19965c04a4c521e703f6607924"},{"url":"https://git.kernel.org/stable/c/ab9ddc87a9055c4bebd6524d5d761d605d52e557"}],"title":"SMB3: Add missing locks to protect deferred close file list","x_generator":{"engine":"bippy-1.2.0"}}}}