What’s Vulnerable › Vulnerabilities

CVE-2023-53377: cifs: prevent use-after-free by freeing the cfile later

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-18 · updated 2026-06-17
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent use-after-free by freeing the cfile later In smb2_compound_op we have a possible use-after-free which can cause hard to debug problems later on. This was revealed during stress testing with KASAN enabled kernel. Fixing it by moving the cfile free call to a few lines below, after the usage.

Affected products

• Linux kernel: from 6.0.16 before 6.1.39; from 6.2 before 6.3.13; from 6.4 before 6.4.4 — fixed in 6.1.39, 6.3.13, 6.4.4

How to fix

Upgrade to a fixed version: Linux kernel 6.1.39, 6.3.13, 6.4.4. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/33f736187d08f6bc822117629f263b97d3df4165
• https://git.kernel.org/stable/c/4fe07d55a5461e66a55fbefb57f85ff0facea32b
• https://git.kernel.org/stable/c/b6353518ef8180816e863aa23b06456f395404d6
• https://git.kernel.org/stable/c/d017880782cf71f8820ee4a2002843893176501d

Get alerted when CVE-2023-53377 or the next vulnerability affects your stack