CVE-2023-53377 Details
Description
In the Linux kernel, the following vulnerability has been resolved: cifs: prevent use-after-free by freeing the cfile later In smb2_compound_op we have a possible use-after-free which can cause hard to debug problems later on. This was revealed during stress testing with KASAN enabled kernel. Fixing it by moving the cfile free call to a few lines below, after the usage.
A use-after-free vulnerability has been identified in the CIFS (Common Internet File System) component of the Linux kernel, specifically within the SMB2 (Server Message Block) protocol handling. This vulnerability was discovered during stress testing with the Kernel Address Sanitizer (KASAN) enabled, and it has the potential to cause hard-to-debug issues later on. The problem arises because a file structure, referred to as 'cfile', is freed before it is no longer needed, creating a window where the memory can be accessed after it has been released.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that fixes this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/33f736187d08f6bc822117629f263b97d3df4165 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4fe07d55a5461e66a55fbefb57f85ff0facea32b | kernel.org | Patch |
| https://git.kernel.org/stable/c/b6353518ef8180816e863aa23b06456f395404d6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d017880782cf71f8820ee4a2002843893176501d | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
| CWE-416 | Use After Free | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.0.16, < 6.1.39 >= 6.2, < 6.3.13 >= 6.4, < 6.4.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 14, 2026 | CVE Modified | CISA-ADP |
| Dec 12, 2025 | Initial Analysis | [email protected] |
| Sep 18, 2025 | New CVE Received | kernel.org |