CVE-2024-53095

A flaw was found in the Linux kernel's Server Message Block (SMB) client. Improper reference counting allows kernel sockets to persist after their associated network namespace has been released. A local attacker with permission to create and destroy network namespaces—such as in containerized environments—can trigger this use-after-free condition during unmounting or reconnection attempts. This flaw primarily results in a system crash leading to a Denial of Service (DoS), with a potential risk of arbitrary memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the CIFS kernel module if SMB/CIFS filesystem mounts are not required:

1. Add a configuration file to prevent the module from loading:

echo "install cifs /bin/true" > /etc/modprobe.d/disable-cifs.conf

2. If the module is currently loaded, unload it:

modprobe -r cifs

Caveats: Applying this configuration will prevent the host and any containers from mounting SMB/CIFS network shares. If the module is already in use by active mounts, unloading it will fail, and a system restart will be required for the change to take effect.