CVE-2023-54162 (GCVE-0-2023-54162)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:03 – Updated: 2026-08-05 09:17
VLAI
Title
ksmbd: fix possible memory leak in smb2_lock()
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix possible memory leak in smb2_lock() argv needs to be free when setup_async_work fails or when the current process is woken up.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < bfe8372ef2dbdce97f13b21d76e2080ddeef5a79 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 6bf555ed8938444466c3d7f3252eb874a518f293 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 11d38f8a0c19763e34d2093b5ecb640e012cb2d2 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < d3ca9f7aeba793d74361d88a8800b2f205c9236b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.145 , ≤ 5.15.* (semver)
Unaffected: 6.1.16 , ≤ 6.1.* (semver)
Unaffected: 6.2.3 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/smb2pdu.c",
            "fs/ksmbd/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bfe8372ef2dbdce97f13b21d76e2080ddeef5a79",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "6bf555ed8938444466c3d7f3252eb874a518f293",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "11d38f8a0c19763e34d2093b5ecb640e012cb2d2",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "d3ca9f7aeba793d74361d88a8800b2f205c9236b",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ksmbd/smb2pdu.c",
            "fs/ksmbd/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.16",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix possible memory leak in smb2_lock()\n\nargv needs to be free when setup_async_work fails or when the current\nprocess is woken up."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - smb2_lock()/smb2_cancel() are ksmbd SMB2 command handlers reached directly from remote packets on TCP/445, with no local access required. The entire race is driven by SMB2_LOCK, SMB2_CANCEL and SMB2_CLOSE PDUs sent by a remote client.\nAC:L - The attacker controls both sides of every race \u2014 it issues the blocking SMB2_LOCK, then pipelines SMB2_CANCEL/SMB2_CLOSE, which ksmbd dispatches as concurrent workqueue items on the same connection, and can repeat indefinitely across many connections. The argv leak itself is deterministic on every cancelled or woken deferred lock.\nPR:L - SMB2_LOCK requires an established session, tree connect and an open file handle, so a low-privileged authenticated SMB user (or a guest-mapped account on typical NAS/embedded configs) suffices; no administrative rights are needed. Upstream reproduced the sibling bugs on this same path \"by an authenticated SMB client\".\nUI:N - The attacker drives the whole sequence from its own SMB connection; no action by any local user or administrator is needed. The contending lock, the cancel and the close are all attacker-initiated.\nS:U - The corruption and resource exhaustion stay within the kernel\u0027s own security authority on the SMB server host. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The stale cancel_fn/cancel_argv leave a use-after-free on a freed struct file_lock (192-byte file_lock_cache, easily sprayed by an attacker holding many byte-range locks) and on the freed ksmbd_work, giving read access to reallocated kernel heap contents. UAF of this kind is treated as High confidentiality impact.\nI:H - The UAF is exercised through an indirect call \u2014 smb2_cancel() invokes cancel_fn from a freed ksmbd_work, and smb2_remove_blocked_lock()\u0027s wake_up() walks a freed waitqueue calling curr-\u003efunc() \u2014 providing a control-flow hijack / arbitrary-write primitive once the slab is reclaimed with attacker-shaped data.\nA:H - The double list_del of work-\u003efp_entry writes through LIST_POISON and oopses a kworker while it holds fp-\u003ef_lock, permanently wedging that spinlock; the file_lock UAF crashes the kernel outright, and the unbounded argv leak drives the server to memory exhaustion. All are remotely repeatable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:44.673Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bfe8372ef2dbdce97f13b21d76e2080ddeef5a79"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bf555ed8938444466c3d7f3252eb874a518f293"
        },
        {
          "url": "https://git.kernel.org/stable/c/11d38f8a0c19763e34d2093b5ecb640e012cb2d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3ca9f7aeba793d74361d88a8800b2f205c9236b"
        }
      ],
      "title": "ksmbd: fix possible memory leak in smb2_lock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54162",
    "datePublished": "2025-12-30T12:03:23.583Z",
    "dateReserved": "2025-12-24T13:02:52.531Z",
    "dateUpdated": "2026-08-05T09:17:44.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54162",
      "date": "2026-08-31",
      "epss": "0.00378",
      "percentile": "0.30764"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54162\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T12:15:44.373\",\"lastModified\":\"2026-08-04T11:16:34.700\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: fix possible memory leak in smb2_lock()\\n\\nargv needs to be free when setup_async_work fails or when the current\\nprocess is woken up.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ksmbd/smb2pdu.c\",\"fs/ksmbd/vfs_cache.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"bfe8372ef2dbdce97f13b21d76e2080ddeef5a79\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"6bf555ed8938444466c3d7f3252eb874a518f293\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"11d38f8a0c19763e34d2093b5ecb640e012cb2d2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"d3ca9f7aeba793d74361d88a8800b2f205c9236b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ksmbd/smb2pdu.c\",\"fs/ksmbd/vfs_cache.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.145\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.16\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.3\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11d38f8a0c19763e34d2093b5ecb640e012cb2d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6bf555ed8938444466c3d7f3252eb874a518f293\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bfe8372ef2dbdce97f13b21d76e2080ddeef5a79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d3ca9f7aeba793d74361d88a8800b2f205c9236b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-21T10:10:26+00:00",
      "cve": "CVE-2023-54162",
      "id": "CVE-2023-54162",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: Denial of Service via memory leak in smb2_lock()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54162.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T02:06:15Z",
      "cve": "CVE-2023-54162",
      "id": "CVE-2023-54162",
      "initial_release_date": "2025-12-31T00:29:31Z",
      "product_status:known_not_affected": "453",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54162",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54162.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.