{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-53990",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-53990"
  ],
  "published": "2025-12-24T10:57:20Z",
  "summary": "SMB3: Add missing locks to protect deferred close file list",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nSMB3: Add missing locks to protect deferred close file list\n\ncifs_del_deferred_close function has a critical section which modifies\nthe deferred close file list. We must acquire deferred_lock before\ncalling cifs_del_deferred_close function.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.21-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v6",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v7l",
            "binary_version": "1:6.1.21-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi1-rpi-v8",
            "binary_version": "1:6.1.21-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.21-1+rpt1": {
            "linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed",
            "upstream_version": "6.1.21",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.28"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53990"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0f87e18203bd30f71eb1a65259e28e291b6cc43a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3aa9d065b0685b4e6052f3f2a2462966fdc44fd2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cb36365dac25d546ca4af0eb22acb43c9b4ddfdf"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/32a046ccaeea6c19965c04a4c521e703f6607924"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ab9ddc87a9055c4bebd6524d5d761d605d52e557"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - This is the SMB client (fs/cifs/), and the race is driven by local syscalls \u2014 open(2)/close(2) racing against unlink(2)/rename(2) on a mounted CIFS/SMB3 share. No network peer input is needed to trigger the unlocked list manipulation.\nAC:L - The attacker controls both sides of the race entirely, spawning one thread looping open/close and another looping rename/unlink on the same share, and can retry indefinitely. The only precondition \u2014 an RHW lease enabling deferred closes \u2014 is the default behavior of Samba/Windows servers and can be guaranteed by pointing the mount at an attacker-controlled server.\nPR:L - Only an unprivileged local user with access to an already-mounted CIFS share is needed; cifs_unlink(), cifs_rename2(), cifs_open() and cifs_close() perform no capability checks on the path to cifs_del_deferred_close(). The mount itself is a normal environmental condition in enterprise, container, and desktop deployments.\nUI:N - The attacker performs all the racing file operations itself with no victim involvement; the presence of the mount is an environmental precondition rather than an action the exploit must induce a user to take.\nS:U - The corruption is confined to kernel slab memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Unsynchronized list_del plus kfree of struct cifs_deferred_close against concurrent list_add/list_del yields a double-free and use-after-free on a shared kmalloc-64 slab, and cifs_is_deferred_close() walks the list while it is being freed, giving an attacker who reclaims the object an arbitrary kernel-memory read primitive.\nI:H - The double-free of a 48-byte object in a general-purpose slab cache is a classic heap-spray primitive allowing the attacker to reclaim the chunk with an attacker-controlled structure and obtain an arbitrary write, and the corrupted list_head permits controlled writes via subsequent list_del operations.\nA:H - Even without full exploitation, concurrent list_del on the deferred_closes list corrupts list pointers and double-frees memory, producing list_del corruption BUG()s, KASAN splats, and kernel panics that are repeatedly triggerable by any local user with share access."
    }
  }
}