GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53990 (GCVE-0-2023-53990)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:55 – Updated: 2026-08-05 09:16
VLAI
Title
SMB3: Add missing locks to protect deferred close file list
Summary
In the Linux kernel, the following vulnerability has been resolved: SMB3: Add missing locks to protect deferred close file list cifs_del_deferred_close function has a critical section which modifies the deferred close file list. We must acquire deferred_lock before calling cifs_del_deferred_close function.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 860efae127888ae535bc4eda1b7f27642727c69e , < 0f87e18203bd30f71eb1a65259e28e291b6cc43a (git)
Affected: ca08d0eac020d48a3141dbec0a3cf64fbdb17cde , < 3aa9d065b0685b4e6052f3f2a2462966fdc44fd2 (git)
Affected: ca08d0eac020d48a3141dbec0a3cf64fbdb17cde , < cb36365dac25d546ca4af0eb22acb43c9b4ddfdf (git)
Affected: ca08d0eac020d48a3141dbec0a3cf64fbdb17cde , < 32a046ccaeea6c19965c04a4c521e703f6607924 (git)
Affected: ca08d0eac020d48a3141dbec0a3cf64fbdb17cde , < ab9ddc87a9055c4bebd6524d5d761d605d52e557 (git)
Affected: 60b6d38add7b9c17d6e5d49ee8e930ea1a5650c5 (git)
Affected: 5.15.63 , < 5.15.111 (semver)
Affected: 5.19.4 , < 5.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 5.15.111 , ≤ 5.15.* (semver)
Unaffected: 6.1.28 , ≤ 6.1.* (semver)
Unaffected: 6.2.15 , ≤ 6.2.* (semver)
Unaffected: 6.3.2 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f87e18203bd30f71eb1a65259e28e291b6cc43a",
              "status": "affected",
              "version": "860efae127888ae535bc4eda1b7f27642727c69e",
              "versionType": "git"
            },
            {
              "lessThan": "3aa9d065b0685b4e6052f3f2a2462966fdc44fd2",
              "status": "affected",
              "version": "ca08d0eac020d48a3141dbec0a3cf64fbdb17cde",
              "versionType": "git"
            },
            {
              "lessThan": "cb36365dac25d546ca4af0eb22acb43c9b4ddfdf",
              "status": "affected",
              "version": "ca08d0eac020d48a3141dbec0a3cf64fbdb17cde",
              "versionType": "git"
            },
            {
              "lessThan": "32a046ccaeea6c19965c04a4c521e703f6607924",
              "status": "affected",
              "version": "ca08d0eac020d48a3141dbec0a3cf64fbdb17cde",
              "versionType": "git"
            },
            {
              "lessThan": "ab9ddc87a9055c4bebd6524d5d761d605d52e557",
              "status": "affected",
              "version": "ca08d0eac020d48a3141dbec0a3cf64fbdb17cde",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60b6d38add7b9c17d6e5d49ee8e930ea1a5650c5",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.111",
              "status": "affected",
              "version": "5.15.63",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.111",
                  "versionStartIncluding": "5.15.63",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSMB3: Add missing locks to protect deferred close file list\n\ncifs_del_deferred_close function has a critical section which modifies\nthe deferred close file list. We must acquire deferred_lock before\ncalling cifs_del_deferred_close function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - This is the SMB client (fs/cifs/), and the race is driven by local syscalls \u2014 open(2)/close(2) racing against unlink(2)/rename(2) on a mounted CIFS/SMB3 share. No network peer input is needed to trigger the unlocked list manipulation.\nAC:L - The attacker controls both sides of the race entirely, spawning one thread looping open/close and another looping rename/unlink on the same share, and can retry indefinitely. The only precondition \u2014 an RHW lease enabling deferred closes \u2014 is the default behavior of Samba/Windows servers and can be guaranteed by pointing the mount at an attacker-controlled server.\nPR:L - Only an unprivileged local user with access to an already-mounted CIFS share is needed; cifs_unlink(), cifs_rename2(), cifs_open() and cifs_close() perform no capability checks on the path to cifs_del_deferred_close(). The mount itself is a normal environmental condition in enterprise, container, and desktop deployments.\nUI:N - The attacker performs all the racing file operations itself with no victim involvement; the presence of the mount is an environmental precondition rather than an action the exploit must induce a user to take.\nS:U - The corruption is confined to kernel slab memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Unsynchronized list_del plus kfree of struct cifs_deferred_close against concurrent list_add/list_del yields a double-free and use-after-free on a shared kmalloc-64 slab, and cifs_is_deferred_close() walks the list while it is being freed, giving an attacker who reclaims the object an arbitrary kernel-memory read primitive.\nI:H - The double-free of a 48-byte object in a general-purpose slab cache is a classic heap-spray primitive allowing the attacker to reclaim the chunk with an attacker-controlled structure and obtain an arbitrary write, and the corrupted list_head permits controlled writes via subsequent list_del operations.\nA:H - Even without full exploitation, concurrent list_del on the deferred_closes list corrupts list pointers and double-frees memory, producing list_del corruption BUG()s, KASAN splats, and kernel panics that are repeatedly triggerable by any local user with share access."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:31.988Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f87e18203bd30f71eb1a65259e28e291b6cc43a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3aa9d065b0685b4e6052f3f2a2462966fdc44fd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb36365dac25d546ca4af0eb22acb43c9b4ddfdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/32a046ccaeea6c19965c04a4c521e703f6607924"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab9ddc87a9055c4bebd6524d5d761d605d52e557"
        }
      ],
      "title": "SMB3: Add missing locks to protect deferred close file list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53990",
    "datePublished": "2025-12-24T10:55:29.156Z",
    "dateReserved": "2025-12-24T10:53:46.175Z",
    "dateUpdated": "2026-08-05T09:16:31.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53990",
      "date": "2026-09-15",
      "epss": "0.0015",
      "percentile": "0.04516"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53990\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:15:51.900\",\"lastModified\":\"2026-08-04T10:19:24.980\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSMB3: Add missing locks to protect deferred close file list\\n\\ncifs_del_deferred_close function has a critical section which modifies\\nthe deferred close file list. We must acquire deferred_lock before\\ncalling cifs_del_deferred_close function.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cifs/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"860efae127888ae535bc4eda1b7f27642727c69e\",\"lessThan\":\"0f87e18203bd30f71eb1a65259e28e291b6cc43a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ca08d0eac020d48a3141dbec0a3cf64fbdb17cde\",\"lessThan\":\"3aa9d065b0685b4e6052f3f2a2462966fdc44fd2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ca08d0eac020d48a3141dbec0a3cf64fbdb17cde\",\"lessThan\":\"cb36365dac25d546ca4af0eb22acb43c9b4ddfdf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ca08d0eac020d48a3141dbec0a3cf64fbdb17cde\",\"lessThan\":\"32a046ccaeea6c19965c04a4c521e703f6607924\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ca08d0eac020d48a3141dbec0a3cf64fbdb17cde\",\"lessThan\":\"ab9ddc87a9055c4bebd6524d5d761d605d52e557\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"60b6d38add7b9c17d6e5d49ee8e930ea1a5650c5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.63\",\"lessThan\":\"5.15.111\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.19.4\",\"lessThan\":\"5.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cifs/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.111\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.28\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.15\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.2\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f87e18203bd30f71eb1a65259e28e291b6cc43a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/32a046ccaeea6c19965c04a4c521e703f6607924\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3aa9d065b0685b4e6052f3f2a2462966fdc44fd2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ab9ddc87a9055c4bebd6524d5d761d605d52e557\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cb36365dac25d546ca4af0eb22acb43c9b4ddfdf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:54:45+00:00",
      "cve": "CVE-2023-53990",
      "id": "CVE-2023-53990",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "152",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: SMB3: Add missing locks to protect deferred close file list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53990.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T16:46:43Z",
      "cve": "CVE-2023-53990",
      "id": "CVE-2023-53990",
      "initial_release_date": "2025-12-25T00:58:16Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "432",
      "product_status:recommended": "225",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53990",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53990.json",
      "version": "22"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.