CVE-2023-54258

cifs: fix potential oops in cifs_oplock_break

State: Published
Severity: 9.8 Critical
Published: Dec 30, 2025
Updated: Oct 15, 2026
Reserved: Dec 30, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix potential oops in cifs_oplock_break

With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can occur just before we were checking if the tcon->ses is valid. See below:

[Fri Aug 4 04:12:50 2023] RIP: 0010:cifs_oplock_break+0x1f7/0x5b0 [cifs] [Fri Aug 4 04:12:50 2023] Code: 7d a8 48 8b 7d c0 c0 e9 02 48 89 45 b8 41 89 cf e8 3e f5 ff ff 4c 89 f7 41 83 e7 01 e8 82 b3 03 f2 49 8b 45 50 48 85 c0 74 5e <48> 83 78 60 00 74 57 45 84 ff 75 52 48 8b 43 98 48 83 eb 68 48 39 [Fri Aug 4 04:12:50 2023] RSP: 0018:ffffb30607ddbdf8 EFLAGS: 00010206 [Fri Aug 4 04:12:50 2023] RAX: 632d223d32612022 RBX: ffff97136944b1e0 RCX: 0000000080100009 [Fri Aug 4 04:12:50 2023] RDX: 0000000000000001 RSI: 0000000080100009 RDI: ffff97136944b188 [Fri Aug 4 04:12:50 2023] RBP: ffffb30607ddbe58 R08: 0000000000000001 R09: ffffffffc08e0900 [Fri Aug 4 04:12:50 2023] R10: 0000000000000001 R11: 000000000000000f R12: ffff97136944b138 [Fri Aug 4 04:12:50 2023] R13: ffff97149147c000 R14: ffff97136944b188 R15: 0000000000000000 [Fri Aug 4 04:12:50 2023] FS: 0000000000000000(0000) GS:ffff9714f7c00000(0000) knlGS:0000000000000000 [Fri Aug 4 04:12:50 2023] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [Fri Aug 4 04:12:50 2023] CR2: 00007fd8de9c7590 CR3: 000000011228e000 CR4: 0000000000350ef0 [Fri Aug 4 04:12:50 2023] Call Trace: [Fri Aug 4 04:12:50 2023] <TASK> [Fri Aug 4 04:12:50 2023] process_one_work+0x225/0x3d0 [Fri Aug 4 04:12:50 2023] worker_thread+0x4d/0x3e0 [Fri Aug 4 04:12:50 2023] ? process_one_work+0x3d0/0x3d0 [Fri Aug 4 04:12:50 2023] kthread+0x12a/0x150 [Fri Aug 4 04:12:50 2023] ? set_kthread_struct+0x50/0x50 [Fri Aug 4 04:12:50 2023] ret_from_fork+0x22/0x30 [Fri Aug 4 04:12:50 2023] </TASK>

To fix this change the ordering of the checks before sending the oplock_response to first check if the openFileList is empty.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	63fb45ddc491895c4b36664e0c2c3b548545ae93 to before b99f490ea87ebcca3a429fd8837067feb56a4c7cAffected 1bf709b9625001eefdd41048c5f4c7544ee33394 to before 5ee28bcfbaacf289eb25c662a2862542ea6ce6a7Affected 3b4c15171c3ce9120c81f5564b9367d8d0f4219c to before 6b67a6d2e50634fe127e656147c81915955e9f5eAffected da787d5b74983f7525d1eb4b9c0b4aff2821511a to before e8f5f849ffce24490eb9449e98312b66c0dba76fAffected cff7fb969edaeff2bc80c8a8f7cf7b0c8df32da7Affected 6.3.13 to before 6.4Affected
LinuxLinux	5.15.121 to before 5.15.128Affected 6.1.39 to before 6.1.47Affected 6.4.4 to before 6.4.12Affected

Product

Versions

LinuxLinux

63fb45ddc491895c4b36664e0c2c3b548545ae93 to before b99f490ea87ebcca3a429fd8837067feb56a4c7cAffected
1bf709b9625001eefdd41048c5f4c7544ee33394 to before 5ee28bcfbaacf289eb25c662a2862542ea6ce6a7Affected
3b4c15171c3ce9120c81f5564b9367d8d0f4219c to before 6b67a6d2e50634fe127e656147c81915955e9f5eAffected
da787d5b74983f7525d1eb4b9c0b4aff2821511a to before e8f5f849ffce24490eb9449e98312b66c0dba76fAffected
cff7fb969edaeff2bc80c8a8f7cf7b0c8df32da7Affected
6.3.13 to before 6.4Affected

LinuxLinux

5.15.121 to before 5.15.128Affected
6.1.39 to before 6.1.47Affected
6.4.4 to before 6.4.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.