CVE-2024-53186 (GCVE-0-2024-53186)

Vulnerability from cvelistv5 – Published: 2024-12-27 13:49 – Updated: 2026-08-05 11:44
VLAI
Title
ksmbd: fix use-after-free in SMB request handling
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in SMB request handling A race condition exists between SMB request handling in `ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the workqueue handler `handle_ksmbd_work()`. This leads to a UAF. - KASAN: slab-use-after-free Read in handle_ksmbd_work - KASAN: slab-use-after-free in rtlock_slowlock_locked This race condition arises as follows: - `ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero: `wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);` - Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using `atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls `ksmbd_conn_free()`, which frees `conn`. - However, after `handle_ksmbd_work()` decrements `conn->r_count`, it may still access `conn->r_count_q` in the following line: `waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)` This results in a UAF, as `conn` has already been freed. The discovery of this UAF can be referenced in the following PR for syzkaller's support for SMB requests.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-10 17:13 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 18f06bacc197d4ac9b518ad1c69999bc3d83e7aa , < a96f9eb7add30ba0fafcfe7b7aca090978196800 (git)
Affected: e9dac92f4482a382e8c0fe1bc243da5fc3526b0c , < f20b77f7897e6aab9ce5527e6016ad2be5d70a33 (git)
Affected: ee426bfb9d09b29987369b897fe9b6485ac2be27 , < 96261adb998a3b513468b6ce17dbec76be5507d4 (git)
Affected: ee426bfb9d09b29987369b897fe9b6485ac2be27 , < 9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e (git)
Affected: 9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b (git)
Affected: 6.6.55 , < 6.6.64 (semver)
Affected: 6.11.3 , < 6.11.11 (semver)
Affected: 6.10.14 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.6.64 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T17:13:00.740506Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T17:21:09.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/server.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a96f9eb7add30ba0fafcfe7b7aca090978196800",
              "status": "affected",
              "version": "18f06bacc197d4ac9b518ad1c69999bc3d83e7aa",
              "versionType": "git"
            },
            {
              "lessThan": "f20b77f7897e6aab9ce5527e6016ad2be5d70a33",
              "status": "affected",
              "version": "e9dac92f4482a382e8c0fe1bc243da5fc3526b0c",
              "versionType": "git"
            },
            {
              "lessThan": "96261adb998a3b513468b6ce17dbec76be5507d4",
              "status": "affected",
              "version": "ee426bfb9d09b29987369b897fe9b6485ac2be27",
              "versionType": "git"
            },
            {
              "lessThan": "9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e",
              "status": "affected",
              "version": "ee426bfb9d09b29987369b897fe9b6485ac2be27",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.64",
              "status": "affected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11.11",
              "status": "affected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/server.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "6.6.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "6.11.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in SMB request handling\n\nA race condition exists between SMB request handling in\n`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the\nworkqueue handler `handle_ksmbd_work()`. This leads to a UAF.\n- KASAN: slab-use-after-free Read in handle_ksmbd_work\n- KASAN: slab-use-after-free in rtlock_slowlock_locked\n\nThis race condition arises as follows:\n- `ksmbd_conn_handler_loop()` waits for `conn-\u003er_count` to reach zero:\n  `wait_event(conn-\u003er_count_q, atomic_read(\u0026conn-\u003er_count) == 0);`\n- Meanwhile, `handle_ksmbd_work()` decrements `conn-\u003er_count` using\n  `atomic_dec_return(\u0026conn-\u003er_count)`, and if it reaches zero, calls\n  `ksmbd_conn_free()`, which frees `conn`.\n- However, after `handle_ksmbd_work()` decrements `conn-\u003er_count`,\n  it may still access `conn-\u003er_count_q` in the following line:\n  `waitqueue_active(\u0026conn-\u003er_count_q)` or `wake_up(\u0026conn-\u003er_count_q)`\n  This results in a UAF, as `conn` has already been freed.\n\nThe discovery of this UAF can be referenced in the following PR for\nsyzkaller\u0027s support for SMB requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445; the vulnerable work-completion path is driven entirely by PDUs received from a remote peer and by remote connection teardown. No local access is needed.\nAC:L - The attacker controls both sides of the race \u2014 queuing SMB work items (raising conn-\u003er_count) and abruptly closing the TCP connection to drive ksmbd_conn_handler_loop into wait_event/free \u2014 and can retry indefinitely across many parallel connections; syzkaller reproduced it without targeting.\nPR:N - queue_ksmbd_work()/handle_ksmbd_work() run for every received PDU including the very first SMB2 NEGOTIATE, before session setup or any credential validation, so an unauthenticated remote attacker reaches the bug.\nUI:N - Exploitation requires only that the attacker open connections and send/close them; no action by any local user or administrator is involved.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed ksmbd_conn is a sprayable general-cache allocation, and the UAF read of conn-\u003er_count_q plus the list walk in wake_up() over reclaimed memory can be leveraged into kernel memory disclosure and, via the resulting control primitive, arbitrary read.\nI:H - wake_up() on the freed waitqueue writes to freed memory (spinlock acquisition and list_del in the wake function) and performs an indirect call through curr-\u003efunc taken from reclaimed, attacker-sprayable memory, giving a control-flow hijack / arbitrary write primitive.\nA:H - Even without successful exploitation, the use-after-free reliably produces slab corruption, KASAN splats, and kernel oops/panic in handle_ksmbd_work or the RT lock slowpath, and can be triggered repeatedly by an unauthenticated remote peer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:44:29.475Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a96f9eb7add30ba0fafcfe7b7aca090978196800"
        },
        {
          "url": "https://git.kernel.org/stable/c/f20b77f7897e6aab9ce5527e6016ad2be5d70a33"
        },
        {
          "url": "https://git.kernel.org/stable/c/96261adb998a3b513468b6ce17dbec76be5507d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e"
        }
      ],
      "title": "ksmbd: fix use-after-free in SMB request handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53186",
    "datePublished": "2024-12-27T13:49:29.215Z",
    "dateReserved": "2024-11-19T17:17:25.012Z",
    "dateUpdated": "2026-08-05T11:44:29.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53186",
      "date": "2026-09-22",
      "epss": "0.00458",
      "percentile": "0.39011"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in SMB request handling\n\nA race condition exists between SMB request handling in\n`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the\nworkqueue handler `handle_ksmbd_work()`. This leads to a UAF.\n- KASAN: slab-use-after-free Read in handle_ksmbd_work\n- KASAN: slab-use-after-free in rtlock_slowlock_locked\n\nThis race condition arises as follows:\n- `ksmbd_conn_handler_loop()` waits for `conn-\u003er_count` to reach zero:\n  `wait_event(conn-\u003er_count_q, atomic_read(\u0026conn-\u003er_count) == 0);`\n- Meanwhile, `handle_ksmbd_work()` decrements `conn-\u003er_count` using\n  `atomic_dec_return(\u0026conn-\u003er_count)`, and if it reaches zero, calls\n  `ksmbd_conn_free()`, which frees `conn`.\n- However, after `handle_ksmbd_work()` decrements `conn-\u003er_count`,\n  it may still access `conn-\u003er_count_q` in the following line:\n  `waitqueue_active(\u0026conn-\u003er_count_q)` or `wake_up(\u0026conn-\u003er_count_q)`\n  This results in a UAF, as `conn` has already been freed.\n\nThe discovery of this UAF can be referenced in the following PR for\nsyzkaller\u0027s support for SMB requests."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: se corrige el problema de use-after-free en la gesti\u00f3n de solicitudes SMB Existe una condici\u00f3n de ejecuci\u00f3n entre la gesti\u00f3n de solicitudes SMB en `ksmbd_conn_handler_loop()` y la liberaci\u00f3n de `ksmbd_conn` en el controlador de cola de trabajo `handle_ksmbd_work()`. Esto conduce a una UAF. - KASAN: slab-use-after-free Leer en handle_ksmbd_work - KASAN: slab-use-after-free en rtlock_slowlock_locked Esta condici\u00f3n de ejecuci\u00f3n surge de la siguiente manera: - `ksmbd_conn_handler_loop()` espera a que `conn-\u0026gt;r_count` llegue a cero: `wait_event(conn-\u0026gt;r_count_q, atomic_read(\u0026amp;conn-\u0026gt;r_count) == 0);` - Mientras tanto, `handle_ksmbd_work()` decrementa `conn-\u0026gt;r_count` usando `atomic_dec_return(\u0026amp;conn-\u0026gt;r_count)`, y si llega a cero, llama a `ksmbd_conn_free()`, que libera a `conn`. - Sin embargo, despu\u00e9s de que `handle_ksmbd_work()` disminuya `conn-\u0026gt;r_count`, a\u00fan puede acceder a `conn-\u0026gt;r_count_q` en la siguiente l\u00ednea: `waitqueue_active(\u0026amp;conn-\u0026gt;r_count_q)` o `wake_up(\u0026amp;conn-\u0026gt;r_count_q)` Esto da como resultado un UAF, ya que `conn` ya se ha liberado. Se puede hacer referencia al descubrimiento de este UAF en la siguiente PR para el soporte de syzkaller para solicitudes SMB."
        }
      ],
      "id": "CVE-2024-53186",
      "lastModified": "2024-12-27T14:15:26.083",
      "published": "2024-12-27T14:15:26.083",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/96261adb998a3b513468b6ce17dbec76be5507d4"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/a96f9eb7add30ba0fafcfe7b7aca090978196800"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/f20b77f7897e6aab9ce5527e6016ad2be5d70a33"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Undergoing Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/server.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a96f9eb7add30ba0fafcfe7b7aca090978196800",
                    "status": "affected",
                    "version": "18f06bacc197d4ac9b518ad1c69999bc3d83e7aa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f20b77f7897e6aab9ce5527e6016ad2be5d70a33",
                    "status": "affected",
                    "version": "e9dac92f4482a382e8c0fe1bc243da5fc3526b0c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "96261adb998a3b513468b6ce17dbec76be5507d4",
                    "status": "affected",
                    "version": "ee426bfb9d09b29987369b897fe9b6485ac2be27",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e",
                    "status": "affected",
                    "version": "ee426bfb9d09b29987369b897fe9b6485ac2be27",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.64",
                    "status": "affected",
                    "version": "6.6.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.11.11",
                    "status": "affected",
                    "version": "6.11.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "affected",
                    "version": "6.10.14",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/server/server.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.64",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C813C628-8D83-4585-9CCE-3DE13EBB4454",
                    "versionEndExcluding": "6.6.64",
                    "versionStartIncluding": "6.6.55",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "41AB04F0-1096-4B39-8148-796AB65AA193",
                    "versionEndExcluding": "6.11",
                    "versionStartIncluding": "6.10.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C2F1D9BC-CB2F-488F-90F8-8456CD3C44CB",
                    "versionEndExcluding": "6.11.11",
                    "versionStartIncluding": "6.11.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D8882B1B-2ABC-4838-AC1D-DBDBB5764776",
                    "versionEndExcluding": "6.12.2",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in SMB request handling\n\nA race condition exists between SMB request handling in\n`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the\nworkqueue handler `handle_ksmbd_work()`. This leads to a UAF.\n- KASAN: slab-use-after-free Read in handle_ksmbd_work\n- KASAN: slab-use-after-free in rtlock_slowlock_locked\n\nThis race condition arises as follows:\n- `ksmbd_conn_handler_loop()` waits for `conn-\u003er_count` to reach zero:\n  `wait_event(conn-\u003er_count_q, atomic_read(\u0026conn-\u003er_count) == 0);`\n- Meanwhile, `handle_ksmbd_work()` decrements `conn-\u003er_count` using\n  `atomic_dec_return(\u0026conn-\u003er_count)`, and if it reaches zero, calls\n  `ksmbd_conn_free()`, which frees `conn`.\n- However, after `handle_ksmbd_work()` decrements `conn-\u003er_count`,\n  it may still access `conn-\u003er_count_q` in the following line:\n  `waitqueue_active(\u0026conn-\u003er_count_q)` or `wake_up(\u0026conn-\u003er_count_q)`\n  This results in a UAF, as `conn` has already been freed.\n\nThe discovery of this UAF can be referenced in the following PR for\nsyzkaller\u0027s support for SMB requests."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: se corrige el problema de use-after-free en la gesti\u00f3n de solicitudes SMB Existe una condici\u00f3n de ejecuci\u00f3n entre la gesti\u00f3n de solicitudes SMB en `ksmbd_conn_handler_loop()` y la liberaci\u00f3n de `ksmbd_conn` en el controlador de cola de trabajo `handle_ksmbd_work()`. Esto conduce a una UAF. - KASAN: slab-use-after-free Leer en handle_ksmbd_work - KASAN: slab-use-after-free en rtlock_slowlock_locked Esta condici\u00f3n de ejecuci\u00f3n surge de la siguiente manera: - `ksmbd_conn_handler_loop()` espera a que `conn-\u0026gt;r_count` llegue a cero: `wait_event(conn-\u0026gt;r_count_q, atomic_read(\u0026amp;conn-\u0026gt;r_count) == 0);` - Mientras tanto, `handle_ksmbd_work()` decrementa `conn-\u0026gt;r_count` usando `atomic_dec_return(\u0026amp;conn-\u0026gt;r_count)`, y si llega a cero, llama a `ksmbd_conn_free()`, que libera a `conn`. - Sin embargo, despu\u00e9s de que `handle_ksmbd_work()` disminuya `conn-\u0026gt;r_count`, a\u00fan puede acceder a `conn-\u0026gt;r_count_q` en la siguiente l\u00ednea: `waitqueue_active(\u0026amp;conn-\u0026gt;r_count_q)` o `wake_up(\u0026amp;conn-\u0026gt;r_count_q)` Esto da como resultado un UAF, ya que `conn` ya se ha liberado. Se puede hacer referencia al descubrimiento de este UAF en la siguiente PR para el soporte de syzkaller para solicitudes SMB."
          }
        ],
        "id": "CVE-2024-53186",
        "lastModified": "2026-08-04T11:22:03.150",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-53186",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T17:13:00.740506Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-12-27T14:15:26.083",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/96261adb998a3b513468b6ce17dbec76be5507d4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a96f9eb7add30ba0fafcfe7b7aca090978196800"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f20b77f7897e6aab9ce5527e6016ad2be5d70a33"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              },
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-12T12:14:20+00:00",
      "cve": "CVE-2024-53186",
      "id": "CVE-2024-53186",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix use-after-free in SMB request handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-53186.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-05T00:41:32Z",
      "cve": "CVE-2024-53186",
      "id": "CVE-2024-53186",
      "initial_release_date": "2024-12-28T03:50:39Z",
      "product_status:known_not_affected": "534",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-53186",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-53186.json",
      "version": "20"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-53186",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-10T17:13:00.740506Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-10T17:13:02.169Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/server/server.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "a96f9eb7add30ba0fafcfe7b7aca090978196800",
                  "status": "affected",
                  "version": "18f06bacc197d4ac9b518ad1c69999bc3d83e7aa",
                  "versionType": "git"
                },
                {
                  "lessThan": "f20b77f7897e6aab9ce5527e6016ad2be5d70a33",
                  "status": "affected",
                  "version": "e9dac92f4482a382e8c0fe1bc243da5fc3526b0c",
                  "versionType": "git"
                },
                {
                  "lessThan": "96261adb998a3b513468b6ce17dbec76be5507d4",
                  "status": "affected",
                  "version": "ee426bfb9d09b29987369b897fe9b6485ac2be27",
                  "versionType": "git"
                },
                {
                  "lessThan": "9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e",
                  "status": "affected",
                  "version": "ee426bfb9d09b29987369b897fe9b6485ac2be27",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/server/server.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.12"
                },
                {
                  "lessThan": "6.12",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.64",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.11",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.64",
                      "versionStartIncluding": "6.6.55",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.11",
                      "versionStartIncluding": "6.11.3",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.2",
                      "versionStartIncluding": "6.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.13",
                      "versionStartIncluding": "6.12",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "6.10.14",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in SMB request handling\n\nA race condition exists between SMB request handling in\n`ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the\nworkqueue handler `handle_ksmbd_work()`. This leads to a UAF.\n- KASAN: slab-use-after-free Read in handle_ksmbd_work\n- KASAN: slab-use-after-free in rtlock_slowlock_locked\n\nThis race condition arises as follows:\n- `ksmbd_conn_handler_loop()` waits for `conn-\u003er_count` to reach zero:\n  `wait_event(conn-\u003er_count_q, atomic_read(\u0026conn-\u003er_count) == 0);`\n- Meanwhile, `handle_ksmbd_work()` decrements `conn-\u003er_count` using\n  `atomic_dec_return(\u0026conn-\u003er_count)`, and if it reaches zero, calls\n  `ksmbd_conn_free()`, which frees `conn`.\n- However, after `handle_ksmbd_work()` decrements `conn-\u003er_count`,\n  it may still access `conn-\u003er_count_q` in the following line:\n  `waitqueue_active(\u0026conn-\u003er_count_q)` or `wake_up(\u0026conn-\u003er_count_q)`\n  This results in a UAF, as `conn` has already been freed.\n\nThe discovery of this UAF can be referenced in the following PR for\nsyzkaller\u0027s support for SMB requests."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T13:00:39.217Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/a96f9eb7add30ba0fafcfe7b7aca090978196800"
            },
            {
              "url": "https://git.kernel.org/stable/c/f20b77f7897e6aab9ce5527e6016ad2be5d70a33"
            },
            {
              "url": "https://git.kernel.org/stable/c/96261adb998a3b513468b6ce17dbec76be5507d4"
            },
            {
              "url": "https://git.kernel.org/stable/c/9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e"
            }
          ],
          "title": "ksmbd: fix use-after-free in SMB request handling",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-53186",
        "datePublished": "2024-12-27T13:49:29.215Z",
        "dateReserved": "2024-11-19T17:17:25.012Z",
        "dateUpdated": "2025-05-04T13:00:39.217Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.