CVE-2023-53358 (GCVE-0-2023-53358)

Vulnerability from cvelistv5 – Published: 2025-09-17 14:56 – Updated: 2026-08-05 09:13
VLAI
Title
ksmbd: fix racy issue under cocurrent smb2 tree disconnect
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue under cocurrent smb2 tree disconnect There is UAF issue under cocurrent smb2 tree disconnect. This patch introduce TREE_CONN_EXPIRE flags for tcon to avoid cocurrent access.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 18:43 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < b36295c17fb97424406f0c3ab321b1ccaabb9be8 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < bd80d35725a0cf4df9307bfe2f1a3b2cb983d8e6 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < dc1c17716c099c90948ebb83e2170dd75a3be6b6 (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 39366b47a59d46af15ac57beb0996268bf911f6a (git)
Affected: 0626e6641f6b467447c81dd7678a69c66f7746cf , < 30210947a343b6b3ca13adc9bfc88e1543e16dd5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.145 , ≤ 5.15.* (semver)
Unaffected: 6.1.28 , ≤ 6.1.* (semver)
Unaffected: 6.2.15 , ≤ 6.2.* (semver)
Unaffected: 6.3.2 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53358",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:43:24.919171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:52:59.942Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/mgmt/tree_connect.c",
            "fs/ksmbd/mgmt/tree_connect.h",
            "fs/ksmbd/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b36295c17fb97424406f0c3ab321b1ccaabb9be8",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "bd80d35725a0cf4df9307bfe2f1a3b2cb983d8e6",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "dc1c17716c099c90948ebb83e2170dd75a3be6b6",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "39366b47a59d46af15ac57beb0996268bf911f6a",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "30210947a343b6b3ca13adc9bfc88e1543e16dd5",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/mgmt/tree_connect.c",
            "fs/ksmbd/mgmt/tree_connect.h",
            "fs/ksmbd/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix racy issue under cocurrent smb2 tree disconnect\n\nThere is UAF issue under cocurrent smb2 tree disconnect.\nThis patch introduce TREE_CONN_EXPIRE flags for tcon to avoid cocurrent\naccess."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server reached over TCP/445; smb2_tree_disconnect() is invoked from handle_ksmbd_work() solely on SMB2_TREE_DISCONNECT PDUs from a remote peer, with no local access required.\nAC:L - The attacker controls both sides of the race by issuing concurrent SMB2_TREE_DISCONNECT requests for the same TreeId (parallel ksmbd-io workqueue items via SMB credits) and can retry indefinitely until both paths observe the same tcon before TREE_CONN_EXPIRE exists.\nPR:L - smb2_check_user_session() and smb2_get_ksmbd_tcon() gate TREE_DISCONNECT behind an established session and tree connect, so a low-privileged SMB share user (including guest where mapped) is required; this is post-authentication, not a pre-auth path.\nUI:N - The attacker performs negotiate, session setup, tree connect, and concurrent tree disconnects entirely on its own connections; no victim or administrator action is needed.\nS:U - The use-after-free corrupts ksmbd kernel heap state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Concurrent disconnect double-frees struct ksmbd_tree_connect (share_conf/user pointers), a sprayable slab UAF that yields arbitrary kernel read primitives once the object is reclaimed, consistent with ZDI-CAN-20592 RCE classification.\nI:H - The second disconnect path reads tree_conn fields from freed memory then kfree()s again, enabling heap spray to hijack control flow / arbitrary write; ZDI rates this as remote code execution in kernel context.\nA:H - Even without full exploitation, the double-free/UAF reliably oopses or panics ksmbd worker threads and can be triggered repeatedly over the network to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:13:38.694Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b36295c17fb97424406f0c3ab321b1ccaabb9be8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd80d35725a0cf4df9307bfe2f1a3b2cb983d8e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc1c17716c099c90948ebb83e2170dd75a3be6b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/39366b47a59d46af15ac57beb0996268bf911f6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/30210947a343b6b3ca13adc9bfc88e1543e16dd5"
        }
      ],
      "title": "ksmbd: fix racy issue under cocurrent smb2 tree disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53358",
    "datePublished": "2025-09-17T14:56:48.812Z",
    "dateReserved": "2025-09-17T14:54:09.732Z",
    "dateUpdated": "2026-08-05T09:13:38.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53358",
      "date": "2026-09-25",
      "epss": "0.00374",
      "percentile": "0.28617"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ksmbd/mgmt/tree_connect.c",
                  "fs/ksmbd/mgmt/tree_connect.h",
                  "fs/ksmbd/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b36295c17fb97424406f0c3ab321b1ccaabb9be8",
                    "status": "affected",
                    "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd80d35725a0cf4df9307bfe2f1a3b2cb983d8e6",
                    "status": "affected",
                    "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc1c17716c099c90948ebb83e2170dd75a3be6b6",
                    "status": "affected",
                    "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "39366b47a59d46af15ac57beb0996268bf911f6a",
                    "status": "affected",
                    "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "30210947a343b6b3ca13adc9bfc88e1543e16dd5",
                    "status": "affected",
                    "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ksmbd/mgmt/tree_connect.c",
                  "fs/ksmbd/mgmt/tree_connect.h",
                  "fs/ksmbd/smb2pdu.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6943BD04-722B-4B0F-810D-A5086EA877BB",
                    "versionEndExcluding": "5.15.145",
                    "versionStartIncluding": "5.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "08F855F4-7188-4EE1-BD79-D4B6C7E2EF54",
                    "versionEndExcluding": "6.1.28",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3844A90B-940D-46C3-8D7B-9FF63F1AFC2F",
                    "versionEndExcluding": "6.2.15",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38F6F330-91A0-4675-8B90-6F950471A7CC",
                    "versionEndExcluding": "6.3.2",
                    "versionStartIncluding": "6.3",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix racy issue under cocurrent smb2 tree disconnect\n\nThere is UAF issue under cocurrent smb2 tree disconnect.\nThis patch introduce TREE_CONN_EXPIRE flags for tcon to avoid cocurrent\naccess."
          }
        ],
        "id": "CVE-2023-53358",
        "lastModified": "2026-08-04T10:19:03.247",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-53358",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:43:24.919171Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-17T15:15:39.890",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/30210947a343b6b3ca13adc9bfc88e1543e16dd5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/39366b47a59d46af15ac57beb0996268bf911f6a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b36295c17fb97424406f0c3ab321b1ccaabb9be8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bd80d35725a0cf4df9307bfe2f1a3b2cb983d8e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dc1c17716c099c90948ebb83e2170dd75a3be6b6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:28:44+00:00",
      "cve": "CVE-2023-53358",
      "id": "CVE-2023-53358",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: fix racy issue under cocurrent smb2 tree disconnect",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53358.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:31:08Z",
      "cve": "CVE-2023-53358",
      "id": "CVE-2023-53358",
      "initial_release_date": "2025-09-17T23:27:43Z",
      "product_status:known_not_affected": "523",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53358",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53358.json",
      "version": "11"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.0,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-53358",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-14T18:43:24.919171Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-14T18:43:20.703Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/ksmbd/mgmt/tree_connect.c",
                "fs/ksmbd/mgmt/tree_connect.h",
                "fs/ksmbd/smb2pdu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "b36295c17fb97424406f0c3ab321b1ccaabb9be8",
                  "status": "affected",
                  "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                  "versionType": "git"
                },
                {
                  "lessThan": "bd80d35725a0cf4df9307bfe2f1a3b2cb983d8e6",
                  "status": "affected",
                  "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                  "versionType": "git"
                },
                {
                  "lessThan": "dc1c17716c099c90948ebb83e2170dd75a3be6b6",
                  "status": "affected",
                  "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                  "versionType": "git"
                },
                {
                  "lessThan": "39366b47a59d46af15ac57beb0996268bf911f6a",
                  "status": "affected",
                  "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                  "versionType": "git"
                },
                {
                  "lessThan": "30210947a343b6b3ca13adc9bfc88e1543e16dd5",
                  "status": "affected",
                  "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/ksmbd/mgmt/tree_connect.c",
                "fs/ksmbd/mgmt/tree_connect.h",
                "fs/ksmbd/smb2pdu.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.15"
                },
                {
                  "lessThan": "5.15",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.145",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.28",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.2.*",
                  "status": "unaffected",
                  "version": "6.2.15",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.3.*",
                  "status": "unaffected",
                  "version": "6.3.2",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.4",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.145",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.28",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.2.15",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.3.2",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.4",
                      "versionStartIncluding": "5.15",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix racy issue under cocurrent smb2 tree disconnect\n\nThere is UAF issue under cocurrent smb2 tree disconnect.\nThis patch introduce TREE_CONN_EXPIRE flags for tcon to avoid cocurrent\naccess."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T19:43:24.268Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/b36295c17fb97424406f0c3ab321b1ccaabb9be8"
            },
            {
              "url": "https://git.kernel.org/stable/c/bd80d35725a0cf4df9307bfe2f1a3b2cb983d8e6"
            },
            {
              "url": "https://git.kernel.org/stable/c/dc1c17716c099c90948ebb83e2170dd75a3be6b6"
            },
            {
              "url": "https://git.kernel.org/stable/c/39366b47a59d46af15ac57beb0996268bf911f6a"
            },
            {
              "url": "https://git.kernel.org/stable/c/30210947a343b6b3ca13adc9bfc88e1543e16dd5"
            }
          ],
          "title": "ksmbd: fix racy issue under cocurrent smb2 tree disconnect",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-53358",
        "datePublished": "2025-09-17T14:56:48.812Z",
        "dateReserved": "2025-09-17T14:54:09.732Z",
        "dateUpdated": "2026-05-11T19:43:24.268Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.