CVE-2023-53377

cifs: prevent use-after-free by freeing the cfile later

State: Published
Severity: 7.8 High
Published: Sep 18, 2025
Updated: Aug 5, 2026
Reserved: Sep 17, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: prevent use-after-free by freeing the cfile later

In smb2_compound_op we have a possible use-after-free which can cause hard to debug problems later on.

This was revealed during stress testing with KASAN enabled kernel. Fixing it by moving the cfile free call to a few lines below, after the usage.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	76894f3e2f71177747b8b4763fb180e800279585 to before 4fe07d55a5461e66a55fbefb57f85ff0facea32bAffected 76894f3e2f71177747b8b4763fb180e800279585 to before b6353518ef8180816e863aa23b06456f395404d6Affected 76894f3e2f71177747b8b4763fb180e800279585 to before d017880782cf71f8820ee4a2002843893176501dAffected 76894f3e2f71177747b8b4763fb180e800279585 to before 33f736187d08f6bc822117629f263b97d3df4165Affected 2d046892a493d9760c35fdaefc3017f27f91b621Affected 6.0.16 to before 6.1Affected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.39 through 6.1.Not affected 6.3.13 through 6.3.Not affected 6.4.4 through 6.4.*Not affected 6.5 and laterNot affected

Product

Versions

LinuxLinux

76894f3e2f71177747b8b4763fb180e800279585 to before 4fe07d55a5461e66a55fbefb57f85ff0facea32bAffected
76894f3e2f71177747b8b4763fb180e800279585 to before b6353518ef8180816e863aa23b06456f395404d6Affected
76894f3e2f71177747b8b4763fb180e800279585 to before d017880782cf71f8820ee4a2002843893176501dAffected
76894f3e2f71177747b8b4763fb180e800279585 to before 33f736187d08f6bc822117629f263b97d3df4165Affected
2d046892a493d9760c35fdaefc3017f27f91b621Affected
6.0.16 to before 6.1Affected

LinuxLinux

6.1Affected
before 6.1Not affected
6.1.39 through 6.1.*Not affected
6.3.13 through 6.3.*Not affected
6.4.4 through 6.4.*Not affected
6.5 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.