CVE-2024-53186

A flaw was found in ksmbd, the in-kernel SMB server for Linux. A race condition exists during SMB request handling, where a connection object (ksmbd_conn) can be prematurely freed while still being accessed by the workqueue handler. A remote unauthenticated attacker could exploit this use-after-free vulnerability to cause a kernel crash, leading to a denial of service on the affected system.

A race between ksmbd_conn_handler_loop() and handle_ksmbd_work() could free ksmbd_conn while the workqueue path still touches its waitqueue, causing a use-after-free and kernel crash. The patch adds a temporary reference (refcnt inc/dec) around the decrement of r_count and wakeup, preventing the UAF. Impact is remote denial of service against systems running and exposing ksmbd; no authentication is required, but reliable exploitation beyond DoS is non-trivial due to race timing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.