What’s Vulnerable › Vulnerabilities

CVE-2023-53990: SMB3: Add missing locks to protect deferred close file list

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-24 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: SMB3: Add missing locks to protect deferred close file list cifs_del_deferred_close function has a critical section which modifies the deferred close file list. We must acquire deferred_lock before calling cifs_del_deferred_close function.

Affected products

• Linux kernel: from 5.15.63 before 5.15.111; from 5.19.4 before 5.20; 6.0 — fixed in 5.15.111, 5.20, 6.4

How to fix

Upgrade to a fixed version: Linux kernel 5.15.111, 5.20, 6.4. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0f87e18203bd30f71eb1a65259e28e291b6cc43a
• https://git.kernel.org/stable/c/32a046ccaeea6c19965c04a4c521e703f6607924
• https://git.kernel.org/stable/c/3aa9d065b0685b4e6052f3f2a2462966fdc44fd2
• https://git.kernel.org/stable/c/ab9ddc87a9055c4bebd6524d5d761d605d52e557
• https://git.kernel.org/stable/c/cb36365dac25d546ca4af0eb22acb43c9b4ddfdf

Get alerted when CVE-2023-53990 or the next vulnerability affects your stack