CVE-2023-54076

A use-after-free vulnerability was found in the Linux kernel's SMB client implementation. When handling SMB sessions with DFS (Distributed File System) root sessions, the code fails to properly increment the reference count for both the session and its dfs_root_ses. This can cause the dfs_root_ses to be freed prematurely in a subsequent cifs_put_smb_ses() call, leading to a use-after-free condition.

This flaw affects systems using the SMB/CIFS client with DFS referrals. The use-after-free can occur during session handling when DFS root sessions are involved. Exploitation requires mounting SMB shares with DFS enabled, which is common in enterprise environments with Windows file servers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.