CVE-2023-53990

In the Linux kernel, the following vulnerability has been resolved:

SMB3: Add missing locks to protect deferred close file list

cifs_del_deferred_close function has a critical section which modifies the deferred close file list. We must acquire deferred_lock before calling cifs_del_deferred_close function.

A low impact race condition was found in the Linux kernel CIFS/SMB3 client's deferred close handling, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9. The cifs_del_deferred_close() function modifies the per-inode deferred close file list, but some of its callers invoked it without first acquiring the deferred_lock that protects this critical section. A local user able to generate concurrent close activity on SMB3-mounted files while deferred close work is pending could use this missing locking to corrupt the deferred close list, most likely crashing the kernel (denial of service); in the worst case, the unsynchronized list modification could also lead to kernel memory corruption. Because this flaw is rated Low impact -- exploitation requires local access with low privileges and winning a narrow timing race, and the realistic consequence is a loss of availability (Red Hat CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) -- the fix has been deferred for the affected Red Hat Enterprise Linux 9 update streams; the residual risk of that deferral is a local denial of service on systems with heavy, concurrent SMB3 file-close workloads. Red Hat Enterprise Linux 7 and 8, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those builds, and Red Hat Enterprise Linux 6 is out of support scope. The CVE.org record assigns a higher severity (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because it assumes full confidentiality, integrity, and availability impact; Red Hat's assessment reflects that the verified consequence of this race is availability loss from list corruption rather than controlled confidentiality or integrity compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.