{"api_version":"1","generated_at":"2026-10-15T23:43:48+00:00","cve":"CVE-2023-54280","urls":{"html":"https://cve.report/CVE-2023-54280","api":"https://cve.report/api/cve/CVE-2023-54280.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-54280","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-54280"},"summary":{"title":"cifs: fix potential race when tree connecting ipc","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix potential race when tree connecting ipc\n\nProtect access of TCP_Server_Info::hostname when building the ipc tree\nname as it might get freed in cifsd thread and thus causing an\nuse-after-free bug in __tree_connect_dfs_target().  Also, while at it,\nupdate status of IPC tcon on success and then avoid any extra tree\nconnects.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-12-30 13:16:16","updated_at":"2026-10-15 22:17:57"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/536ec71ba060a02fabe8e22cecb82fe7b3a8708b","name":"https://git.kernel.org/stable/c/536ec71ba060a02fabe8e22cecb82fe7b3a8708b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/553476df55a111e6a66ad9155256aec0ec1b7ad0","name":"https://git.kernel.org/stable/c/553476df55a111e6a66ad9155256aec0ec1b7ad0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ee20d7c6100752eaf2409d783f4f1449c29ea33d","name":"https://git.kernel.org/stable/c/ee20d7c6100752eaf2409d783f4f1449c29ea33d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-54280","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54280","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c88f7dcd6d6429197fc2fd87b54a894ffcd48e8e 536ec71ba060a02fabe8e22cecb82fe7b3a8708b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c88f7dcd6d6429197fc2fd87b54a894ffcd48e8e 553476df55a111e6a66ad9155256aec0ec1b7ad0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected c88f7dcd6d6429197fc2fd87b54a894ffcd48e8e ee20d7c6100752eaf2409d783f4f1449c29ea33d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81d583baa5f1abd73c755ce1992929debd20b687 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.15.81 5.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.16","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.2.15 6.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3.2 6.3.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.4 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2023","cve_id":"54280","cve":"CVE-2023-54280","epss":"0.004470000","percentile":"0.366880000","score_date":"2026-08-06","updated_at":"2026-08-07 00:14:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2023-54280","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-15T21:39:59.690437Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-15T21:41:43.877Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/cifs/dfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"536ec71ba060a02fabe8e22cecb82fe7b3a8708b","status":"affected","version":"c88f7dcd6d6429197fc2fd87b54a894ffcd48e8e","versionType":"git"},{"lessThan":"553476df55a111e6a66ad9155256aec0ec1b7ad0","status":"affected","version":"c88f7dcd6d6429197fc2fd87b54a894ffcd48e8e","versionType":"git"},{"lessThan":"ee20d7c6100752eaf2409d783f4f1449c29ea33d","status":"affected","version":"c88f7dcd6d6429197fc2fd87b54a894ffcd48e8e","versionType":"git"},{"status":"affected","version":"81d583baa5f1abd73c755ce1992929debd20b687","versionType":"git"},{"lessThan":"5.16","status":"affected","version":"5.15.81","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/cifs/dfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.15","versionType":"semver"},{"lessThanOrEqual":"6.3.*","status":"unaffected","version":"6.3.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.4","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.2.15","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3.2","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.81","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix potential race when tree connecting ipc\n\nProtect access of TCP_Server_Info::hostname when building the ipc tree\nname as it might get freed in cifsd thread and thus causing an\nuse-after-free bug in __tree_connect_dfs_target().  Also, while at it,\nupdate status of IPC tcon on success and then avoid any extra tree\nconnects."}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - The race is in the CIFS/SMB client's DFS reconnect path and is driven entirely by remote peer behaviour — a malicious or compromised SMB/DFS server (or an on-path attacker resetting the TCP session) controls when reconnects occur and which failover targets are returned, and the leaked heap bytes are sent back to that server in the TREE_CONNECT request. Both racing threads (cifsd demux thread and the cifsiod reconnect worker) run automatically over the network connection with no local component.\nAC:L - The attacker controls both sides of the race: dropping the TCP connection forces cifsd into reconnect_dfs_server()/__reconnect_target_unlocked() which kfree()s server->hostname, while the referral target list it supplies guarantees the free happens, and the cifsiod reconnect worker concurrently reads the pointer unlocked. reconnect_dfs_server() retries in a msleep(3000) loop so the window can be hit repeatedly until it lands.\nPR:N - The attacker acts as the SMB/DFS server or as a network attacker on the connection and never authenticates to or holds any account on the victim host. The vulnerable reconnect path runs in kernel threads (cifsd and the cifsiod reconnect worker), so no privileged or unprivileged local process is needed at all.\nUI:N - Against an already-mounted DFS share — the normal persistent state for enterprise fstab/autofs mounts — the entire trigger sequence is kernel-internal: cifsd drops and re-establishes the connection and queues smb2_reconnect_server(), which reaches __tree_connect_dfs_target() with no user process and no victim action.\nS:U - The use-after-free is confined to kernel heap memory of the affected host and does not cross a virtualization, IOMMU, or sandbox boundary. Impact and vulnerable component share the same security authority.\nC:H - The freed hostname buffer is formatted with \"%s\", and string_nocheck() runs with precision -1 (`while (lim--)`), so it reads freed and reallocated heap memory unbounded until a NUL byte, copying up to ~500 bytes into the tree name, which is then transmitted to the remote attacker-controlled server in the SMB2 TREE_CONNECT request — a direct kernel heap disclosure primitive.\nI:H - This is a use-after-free on an attacker-influenced heap object; an attacker who grooms the reallocated kmalloc chunk controls the string used to build the IPC$ tree-connect request, steering the client's connection state, and UAF conditions on the CIFS server/session objects are generally leverageable for stronger corruption primitives.\nA:H - The unbounded scan for a NUL over the freed allocation readily walks off the slab object into unmapped memory, producing a kernel oops/panic (and an immediate KASAN BUG on hardened kernels). The remote attacker can retrigger the reconnect race repeatedly until the client crashes."}]}],"providerMetadata":{"dateUpdated":"2026-08-05T09:18:52.296Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/536ec71ba060a02fabe8e22cecb82fe7b3a8708b"},{"url":"https://git.kernel.org/stable/c/553476df55a111e6a66ad9155256aec0ec1b7ad0"},{"url":"https://git.kernel.org/stable/c/ee20d7c6100752eaf2409d783f4f1449c29ea33d"}],"title":"cifs: fix potential race when tree connecting ipc","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2023-54280","datePublished":"2025-12-30T12:23:22.335Z","dateReserved":"2025-12-30T12:06:44.525Z","dateUpdated":"2026-10-15T21:41:43.877Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-12-30 13:16:16","lastModifiedDate":"2026-10-15 22:17:57","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T21:39:59.690437Z","id":"CVE-2023-54280","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"54280","Ordinal":"1","Title":"cifs: fix potential race when tree connecting ipc","CVE":"CVE-2023-54280","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"54280","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix potential race when tree connecting ipc\n\nProtect access of TCP_Server_Info::hostname when building the ipc tree\nname as it might get freed in cifsd thread and thus causing an\nuse-after-free bug in __tree_connect_dfs_target().  Also, while at it,\nupdate status of IPC tcon on success and then avoid any extra tree\nconnects.","Type":"Description","Title":"cifs: fix potential race when tree connecting ipc"}]}}}