CVE-2023-54076

CriticalCVSS 9.8

Published: 24/12/2025(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

In the Linux kernel, the SMB client (cifs) has a missed session refcounting issue. The new helper cifs_smb_ses_inc_refcount() is used to get active references, preventing use-after-free.

Risk Assessment

Use-after-free can occur, leading to system crash or potential code execution by an attacker.

Recommendation

Apply the Linux kernel patch that adds proper session refcounting.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper to get an active reference of @ses and @ses->dfs_root_ses (if set). This will prevent @ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses() and thus potentially causing an use-after-free bug.