CVE-2023-54076
published 2025-12-24CVE-2023-54076: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper to get…
PriorityP344critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.46%
38.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missed ses refcounting
Use new cifs_smb_ses_inc_refcount() helper to get an active reference
of @ses and @ses->dfs_root_ses (if set). This will prevent
@ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses()
and thus potentially causing an use-after-free bug.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.4.11-1 (forky) | linux 6.4.11-1 (forky) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 6.2.15 < 6.3 | 6.3 |
| linux | linux | >= 6.3.2 < 6.4 | 6.4 |
| linux | linux | >= 8e3554150d6c80a84b3cb046615d1a0e943811dc < eb382196e6f6e05cfafdab797840e5a96c6e7bf0 | eb382196e6f6e05cfafdab797840e5a96c6e7bf0 |
| linux | linux | >= 8e3554150d6c80a84b3cb046615d1a0e943811dc < bf99f6be2d20146942bce6f9e90a0ceef12cbc1e | bf99f6be2d20146942bce6f9e90a0ceef12cbc1e |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 6.4.0 < 6.4.7 | 6.4.7 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fm2q-hj9m-hx9r: In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missed ses refcounting
Use new cifs_smb_ses_inc_refcount() help
ghsa_unreviewed·2025-12-24
CVE-2023-54076 GHSA-fm2q-hj9m-hx9r: In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missed ses refcounting
Use new cifs_smb_ses_inc_refcount() help
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missed ses refcounting
Use new cifs_smb_ses_inc_refcount() helper to get an active reference
of @ses and @ses->dfs_root_ses (if set). This will prevent
@ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses()
and thus potentially causing an use-after-free bug.
OSV
smb: client: fix missed ses refcounting
osv·2025-12-24
CVE-2023-54076 smb: client: fix missed ses refcounting
smb: client: fix missed ses refcounting
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missed ses refcounting
Use new cifs_smb_ses_inc_refcount() helper to get an active reference
of @ses and @ses->dfs_root_ses (if set). This will prevent
@ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses()
and thus potentially causing an use-after-free bug.
OSV
CVE-2023-54076: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper
osv·2025-12-24
CVE-2023-54076 CVE-2023-54076: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper to get an active reference of @ses and @ses->dfs_root_ses (if set). This will prevent @ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses() and thus potentially causing an use-after-free bug.
Red Hat
kernel: smb: client: fix missed ses refcounting
vendor_redhat·2025-12-24·CVSS 5.5
CVE-2023-54076 [LOW] CWE-911 kernel: smb: client: fix missed ses refcounting
kernel: smb: client: fix missed ses refcounting
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missed ses refcounting
Use new cifs_smb_ses_inc_refcount() helper to get an active reference
of @ses and @ses->dfs_root_ses (if set). This will prevent
@ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses()
and thus potentially causing an use-after-free bug.
A use-after-free vulnerability was found in the Linux kernel's SMB client implementation. When handling SMB sessions with DFS (Distributed File System) root sessions, the code fails to properly increment the reference count for both the session and its dfs_root_ses. This can cause the dfs_root_ses to be freed prematurely in a subsequent cifs_put_smb_ses() call, leading to a use-after-fre
Debian
CVE-2023-54076: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client...
vendor_debian·2023
CVE-2023-54076 [LOW] CVE-2023-54076: linux - In the Linux kernel, the following vulnerability has been resolved: smb: client...
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper to get an active reference of @ses and @ses->dfs_root_ses (if set). This will prevent @ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses() and thus potentially causing an use-after-free bug.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.4.11-1)
sid: resolved (fixed in 6.4.11-1)
trixie: resolved (fixed in 6.4.11-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-54076 kernel: smb: client: fix missed ses refcounting
bugzilla·2025-12-24
CVE-2023-54076 [LOW] CVE-2023-54076 kernel: smb: client: fix missed ses refcounting
CVE-2023-54076 kernel: smb: client: fix missed ses refcounting
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missed ses refcounting
Use new cifs_smb_ses_inc_refcount() helper to get an active reference
of @ses and @ses->dfs_root_ses (if set). This will prevent
@ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses()
and thus potentially causing an use-after-free bug.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025122433-CVE-2023-54076-e317@gregkh/T
Wiz
CVE-2023-54076 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-54076 CVE-2023-54076 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-54076 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missed ses refcounting
Use new cifs_smb_ses_inc_refcount() helper to get an active reference
of @ses and @ses->dfs_root_ses (if set). This will prevent
@ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses()
and thus potentially causing an use-after-free bug.
Source : NVD
Published December 24, 2025
CNA Score N/A
Affected Technologies
Linux Kernel
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kernel-source-vanilla
kernel-azure-dev
2025-12-24
Published