CVE-2023-53794

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix session state check in reconnect to avoid use-after-free issue

Don't collect exiting session in smb2_reconnect_server(), because it will be released soon.

Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list.

This vulnerability is rated as having a Moderate impact because exploitation depends on tight race conditions during SMB session termination and reconnect sequences, which can trigger a kernel crash resulting in denial of service. In typical Red Hat Enterprise Linux environments, CIFS client filesystems are not mounted by default, limiting exposure to systems configured to interact with remote SMB shares. Additionally, an attacker would need local access to initiate operations that race against an unmounting or reconnecting session to cause instability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.