What’s Vulnerable › Vulnerabilities

CVE-2023-32254: Tree connection race condition remote code execution vulnerability

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-10 · updated 2026-06-17
• Weakness: CWE-362

Description

A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

Affected products

• Linux kernel: from 5.15 before 5.15.145; from 5.16 before 6.1.28; from 6.2 before 6.2.15; from 6.3 before 6.3.2 — fixed in 5.15.145, 6.1.28, 6.2.15, 6.3.2
• NetApp H300S: all versions
• NetApp H410S: all versions
• NetApp H500S: all versions
• NetApp H700S: all versions
• NetApp Hci Management Node: all versions

How to fix

Upgrade to a fixed version: Linux kernel 5.15.145, 6.1.28, 6.2.15, 6.3.2. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2023-32254
• https://bugzilla.redhat.com/show_bug.cgi?id=2191658
• https://security.netapp.com/advisory/ntap-20230824-0004/
• https://www.zerodayinitiative.com/advisories/ZDI-23-702/
• https://access.redhat.com/security/cve/CVE-2023-32254
• https://bugzilla.redhat.com/show_bug.cgi?id=2191658
• https://security.netapp.com/advisory/ntap-20230824-0004/
• https://www.zerodayinitiative.com/advisories/ZDI-23-702/

Get alerted when CVE-2023-32254 or the next vulnerability affects your stack