CVE-2023-54258 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix potential oops in cifs_oplock_break
With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can occur just before we were checking if the tcon->ses is valid. See below:
[Fri Aug 4 04:12:50 2023] RIP: 0010:cifs_oplock_break+0x1f7/0x5b0 [cifs]
[Fri Aug 4 04:12:50 2023] Code: 7d a8 48 8b 7d c0 c0 e9 02 48 89 45 b8 41 89 cf e8 3e f5 ff ff 4c 89 f7 41 83 e7 01 e8 82 b3 03 f2 49 8b 45 50 48 85 c0 74 5e <48> 83 78 60 00 74 57 45 84 ff 75 52 48 8b 43 98 48 83 eb 68 48 39
[Fri Aug 4 04:12:50 2023] RSP: 0018:ffffb30607ddbdf8 EFLAGS: 00010206
[Fri Aug 4 04:12:50 2023] RAX: 632d223d32612022 RBX: ffff97136944b1e0 RCX: 0000000080100009
[Fri Aug 4 04:12:50 2023] RDX: 0000000000000001 RSI: 0000000080100009 RDI: ffff97136944b188
[Fri Aug 4 04:12:50 2023] RBP: ffffb30607ddbe58 R08: 0000000000000001 R09: ffffffffc08e0900
[Fri Aug 4 04:12:50 2023] R10: 0000000000000001 R11: 000000000000000f R12: ffff97136944b138
[Fri Aug 4 04:12:50 2023] R13: ffff97149147c000 R14: ffff97136944b188 R15: 0000000000000000
[Fri Aug 4 04:12:50 2023] FS: 0000000000000000(0000) GS:ffff9714f7c00000(0000) knlGS:0000000000000000
[Fri Aug 4 04:12:50 2023] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[Fri Aug 4 04:12:50 2023] CR2: 00007fd8de9c7590 CR3: 000000011228e000 CR4: 0000000000350ef0
[Fri Aug 4 04:12:50 2023] Call Trace:
[Fri Aug 4 04:12:50 2023] <TASK>
[Fri Aug 4 04:12:50 2023] process_one_work+0x225/0x3d0
[Fri Aug 4 04:12:50 2023] worker_thread+0x4d/0x3e0
[Fri Aug 4 04:12:50 2023] ? process_one_work+0x3d0/0x3d0
[Fri Aug 4 04:12:50 2023] kthread+0x12a/0x150
[Fri Aug 4 04:12:50 2023] ? set_kthread_struct+0x50/0x50
[Fri Aug 4 04:12:50 2023] ret_from_fork+0x22/0x30
[Fri Aug 4 04:12:50 2023] </TASK>
To fix this change the ordering of the checks before sending the oplock_response to first check if the openFileList is empty.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/27/2026
The vulnerability CVE-2023-54258 represents a critical race condition within the Linux kernel's CIFS (Common Internet File System) implementation that can lead to kernel oops and potential system instability. This issue specifically affects the cifs_oplock_break function where concurrent operations between deferred close mechanisms and lease breaks create a scenario that results in invalid memory access. The vulnerability manifests when an unmount operation occurs during the execution of the oplock break process, causing a kernel panic due to dereferencing a freed or invalid data structure. The error trace indicates that the kernel crashes while executing cifs_oplock_break at offset 0x1f7, suggesting that memory access violations occur when attempting to validate session connections during a critical race window.
The root cause of this vulnerability lies in the improper ordering of validation checks within the oplock response mechanism. The CIFS subsystem maintains a list of open files (openFileList) and session connections (tcon->ses) that can become inconsistent during concurrent operations. When deferred close operations race with lease break notifications, the current implementation checks the validity of tcon->ses before verifying whether the file list has been properly cleaned up. This sequence creates a window where the session structure may have been freed or marked for destruction by an unmount operation, yet the code attempts to access its members, resulting in memory corruption and kernel oops. This race condition is particularly dangerous because it can be triggered during normal system operations involving network file access and unmount procedures.
The operational impact of CVE-2023-54258 extends beyond simple system crashes, potentially enabling denial of service attacks against systems running CIFS clients or servers. Attackers could exploit this vulnerability by creating conditions that force concurrent close and lease break operations, leading to system instability and service disruption. The vulnerability affects systems that utilize CIFS mounts, particularly those in enterprise environments where network file sharing is common, and can result in complete system hangs or forced reboots. From a security perspective, this issue falls under CWE-362, which describes race conditions in concurrent execution environments, and aligns with ATT&CK technique T1499.004 for network denial of service attacks. The vulnerability demonstrates how improper synchronization between kernel subsystems can create exploitable conditions that compromise system availability.
The fix for this vulnerability involves reordering the validation checks within the cifs_oplock_break function to ensure that the openFileList is checked for emptiness before validating session connection structures. This modification prevents the kernel from accessing potentially freed memory structures during the lease break response process. The patch ensures that when deferred close operations occur, the system first verifies that no open file references exist before proceeding with session validation, thereby eliminating the race condition that leads to memory corruption. This approach follows established kernel security practices for preventing race conditions in concurrent systems and aligns with the broader security principle of validating data structures before dereferencing them. The mitigation strategy effectively addresses the root cause by enforcing proper ordering of operations that prevents invalid memory access during critical kernel execution paths, ensuring that CIFS operations remain stable even under concurrent access conditions.