CVE-2023-53052 (GCVE-0-2023-53052)

Vulnerability from cvelistv5 – Published: 2025-05-02 15:55 – Updated: 2026-08-05 09:12
VLAI
Title
cifs: fix use-after-free bug in refresh_cache_worker()
Summary
In the Linux kernel, the following vulnerability has been resolved: cifs: fix use-after-free bug in refresh_cache_worker() The UAF bug occurred because we were putting DFS root sessions in cifs_umount() while DFS cache refresher was being executed. Make DFS root sessions have same lifetime as DFS tcons so we can avoid the use-after-free bug is DFS cache refresher and other places that require IPCs to get new DFS referrals on. Also, get rid of mount group handling in DFS cache as we no longer need it. This fixes below use-after-free bug catched by KASAN [ 379.946955] BUG: KASAN: use-after-free in __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.947642] Read of size 8 at addr ffff888018f57030 by task kworker/u4:3/56 [ 379.948096] [ 379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 Not tainted 6.2.0-rc7-lku #23 [ 379.948661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [ 379.949368] Workqueue: cifs-dfscache refresh_cache_worker [cifs] [ 379.949942] Call Trace: [ 379.950113] <TASK> [ 379.950260] dump_stack_lvl+0x50/0x67 [ 379.950510] print_report+0x16a/0x48e [ 379.950759] ? __virt_addr_valid+0xd8/0x160 [ 379.951040] ? __phys_addr+0x41/0x80 [ 379.951285] kasan_report+0xdb/0x110 [ 379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs] [ 379.953637] ? __pfx___mutex_lock+0x10/0x10 [ 379.953915] ? lock_release+0xb6/0x720 [ 379.954167] ? __pfx_lock_acquire+0x10/0x10 [ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs] [ 379.954960] ? __pfx_wb_workfn+0x10/0x10 [ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs] [ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs] [ 379.956323] ? __pfx_lock_acquired+0x10/0x10 [ 379.956615] ? read_word_at_a_time+0xe/0x20 [ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220 [ 379.957235] process_one_work+0x535/0x990 [ 379.957509] ? __pfx_process_one_work+0x10/0x10 [ 379.957812] ? lock_acquired+0xb7/0x5f0 [ 379.958069] ? __list_add_valid+0x37/0xd0 [ 379.958341] ? __list_add_valid+0x37/0xd0 [ 379.958611] worker_thread+0x8e/0x630 [ 379.958861] ? __pfx_worker_thread+0x10/0x10 [ 379.959148] kthread+0x17d/0x1b0 [ 379.959369] ? __pfx_kthread+0x10/0x10 [ 379.959630] ret_from_fork+0x2c/0x50 [ 379.959879] </TASK>
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6916881f443f67f6893b504fa2171468c8aed915 , < 5a89d81c1a3c152837ea204fd29572228e54ce0b (git)
Affected: 6916881f443f67f6893b504fa2171468c8aed915 , < 396935de145589c8bfe552fa03a5e38604071829 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.2.8 , ≤ 6.2.* (semver)
Unaffected: 6.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/cifs_fs_sb.h",
            "fs/cifs/cifsglob.h",
            "fs/cifs/connect.c",
            "fs/cifs/dfs.c",
            "fs/cifs/dfs.h",
            "fs/cifs/dfs_cache.c",
            "fs/cifs/dfs_cache.h",
            "fs/cifs/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5a89d81c1a3c152837ea204fd29572228e54ce0b",
              "status": "affected",
              "version": "6916881f443f67f6893b504fa2171468c8aed915",
              "versionType": "git"
            },
            {
              "lessThan": "396935de145589c8bfe552fa03a5e38604071829",
              "status": "affected",
              "version": "6916881f443f67f6893b504fa2171468c8aed915",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/cifs/cifs_fs_sb.h",
            "fs/cifs/cifsglob.h",
            "fs/cifs/connect.c",
            "fs/cifs/dfs.c",
            "fs/cifs/dfs.h",
            "fs/cifs/dfs_cache.c",
            "fs/cifs/dfs_cache.h",
            "fs/cifs/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.8",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix use-after-free bug in refresh_cache_worker()\n\nThe UAF bug occurred because we were putting DFS root sessions in\ncifs_umount() while DFS cache refresher was being executed.\n\nMake DFS root sessions have same lifetime as DFS tcons so we can avoid\nthe use-after-free bug is DFS cache refresher and other places that\nrequire IPCs to get new DFS referrals on.  Also, get rid of mount\ngroup handling in DFS cache as we no longer need it.\n\nThis fixes below use-after-free bug catched by KASAN\n\n[ 379.946955] BUG: KASAN: use-after-free in __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\n[ 379.947642] Read of size 8 at addr ffff888018f57030 by task kworker/u4:3/56\n[ 379.948096]\n[ 379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 Not tainted 6.2.0-rc7-lku #23\n[ 379.948661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014\n[ 379.949368] Workqueue: cifs-dfscache refresh_cache_worker [cifs]\n[ 379.949942] Call Trace:\n[ 379.950113] \u003cTASK\u003e\n[ 379.950260] dump_stack_lvl+0x50/0x67\n[ 379.950510] print_report+0x16a/0x48e\n[ 379.950759] ? __virt_addr_valid+0xd8/0x160\n[ 379.951040] ? __phys_addr+0x41/0x80\n[ 379.951285] kasan_report+0xdb/0x110\n[ 379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\n[ 379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\n[ 379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\n[ 379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs]\n[ 379.953637] ? __pfx___mutex_lock+0x10/0x10\n[ 379.953915] ? lock_release+0xb6/0x720\n[ 379.954167] ? __pfx_lock_acquire+0x10/0x10\n[ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs]\n[ 379.954960] ? __pfx_wb_workfn+0x10/0x10\n[ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs]\n[ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs]\n[ 379.956323] ? __pfx_lock_acquired+0x10/0x10\n[ 379.956615] ? read_word_at_a_time+0xe/0x20\n[ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220\n[ 379.957235] process_one_work+0x535/0x990\n[ 379.957509] ? __pfx_process_one_work+0x10/0x10\n[ 379.957812] ? lock_acquired+0xb7/0x5f0\n[ 379.958069] ? __list_add_valid+0x37/0xd0\n[ 379.958341] ? __list_add_valid+0x37/0xd0\n[ 379.958611] worker_thread+0x8e/0x630\n[ 379.958861] ? __pfx_worker_thread+0x10/0x10\n[ 379.959148] kthread+0x17d/0x1b0\n[ 379.959369] ? __pfx_kthread+0x10/0x10\n[ 379.959630] ret_from_fork+0x2c/0x50\n[ 379.959879] \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - This is the SMB client (fs/cifs), not an in-kernel network server; the free side is local umount/automount expiry (cifs_umount \u2192 dfs_cache_put_refsrv_sessions) racing the dfscache workqueue, so exploitation requires local system access.\nAC:L - The attacker drives both sides by triggering DFS automounts (or mount/umount) against a share while refresh_cache_worker runs on attacker-influenced referral TTLs, and can retry the umount-vs-worker race indefinitely.\nPR:L - cifs lacks FS_USERNS_MOUNT for ordinary mounts, but any unprivileged user who can traverse an existing DFS CIFS mount can trigger cifs_dfs_d_automount \u2192 fc_mount (no mount_capable check) and later automount expiry into cifs_umount, reaching the UAF without CAP_SYS_ADMIN.\nUI:N - The attacker performs the path-walk/automount and races the cache refresher themselves; an already-mounted DFS share is an environmental precondition, not a victim action at exploit time.\nS:U - The use-after-free is in host kernel heap objects (struct cifs_ses / tcon_ipc) and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - __refresh_tcon reads fields from a freed DFS root cifs_ses (ses-\u003etcon_ipc and later session state); per UAF guidance this enables heap reuse and an arbitrary kernel memory disclosure primitive.\nI:H - The same freed session object can be sprayed/reclaimed before the worker continues, yielding a classic heap UAF write/control-flow hijack primitive against kernel memory.\nA:H - Even without full exploitation, the KASAN-reported use-after-free in __refresh_tcon causes kernel oops/panic and is repeatedly triggerable via the umount/automount race."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:33.775Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5a89d81c1a3c152837ea204fd29572228e54ce0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/396935de145589c8bfe552fa03a5e38604071829"
        }
      ],
      "title": "cifs: fix use-after-free bug in refresh_cache_worker()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53052",
    "datePublished": "2025-05-02T15:55:07.755Z",
    "dateReserved": "2025-04-16T07:18:43.828Z",
    "dateUpdated": "2026-08-05T09:12:33.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53052",
      "date": "2026-08-18",
      "epss": "0.0018",
      "percentile": "0.07908"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53052\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-02T16:15:24.283\",\"lastModified\":\"2026-08-04T10:18:53.380\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: fix use-after-free bug in refresh_cache_worker()\\n\\nThe UAF bug occurred because we were putting DFS root sessions in\\ncifs_umount() while DFS cache refresher was being executed.\\n\\nMake DFS root sessions have same lifetime as DFS tcons so we can avoid\\nthe use-after-free bug is DFS cache refresher and other places that\\nrequire IPCs to get new DFS referrals on.  Also, get rid of mount\\ngroup handling in DFS cache as we no longer need it.\\n\\nThis fixes below use-after-free bug catched by KASAN\\n\\n[ 379.946955] BUG: KASAN: use-after-free in __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\\n[ 379.947642] Read of size 8 at addr ffff888018f57030 by task kworker/u4:3/56\\n[ 379.948096]\\n[ 379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 Not tainted 6.2.0-rc7-lku #23\\n[ 379.948661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\\nrel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014\\n[ 379.949368] Workqueue: cifs-dfscache refresh_cache_worker [cifs]\\n[ 379.949942] Call Trace:\\n[ 379.950113] \u003cTASK\u003e\\n[ 379.950260] dump_stack_lvl+0x50/0x67\\n[ 379.950510] print_report+0x16a/0x48e\\n[ 379.950759] ? __virt_addr_valid+0xd8/0x160\\n[ 379.951040] ? __phys_addr+0x41/0x80\\n[ 379.951285] kasan_report+0xdb/0x110\\n[ 379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\\n[ 379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\\n[ 379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs]\\n[ 379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs]\\n[ 379.953637] ? __pfx___mutex_lock+0x10/0x10\\n[ 379.953915] ? lock_release+0xb6/0x720\\n[ 379.954167] ? __pfx_lock_acquire+0x10/0x10\\n[ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs]\\n[ 379.954960] ? __pfx_wb_workfn+0x10/0x10\\n[ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs]\\n[ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs]\\n[ 379.956323] ? __pfx_lock_acquired+0x10/0x10\\n[ 379.956615] ? read_word_at_a_time+0xe/0x20\\n[ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220\\n[ 379.957235] process_one_work+0x535/0x990\\n[ 379.957509] ? __pfx_process_one_work+0x10/0x10\\n[ 379.957812] ? lock_acquired+0xb7/0x5f0\\n[ 379.958069] ? __list_add_valid+0x37/0xd0\\n[ 379.958341] ? __list_add_valid+0x37/0xd0\\n[ 379.958611] worker_thread+0x8e/0x630\\n[ 379.958861] ? __pfx_worker_thread+0x10/0x10\\n[ 379.959148] kthread+0x17d/0x1b0\\n[ 379.959369] ? __pfx_kthread+0x10/0x10\\n[ 379.959630] ret_from_fork+0x2c/0x50\\n[ 379.959879] \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cifs: se corrige el error de use-after-free en refresh_cache_worker(). El error de UAF se produjo porque se estaban asignando sesiones root de DFS en cifs_umount() mientras se ejecutaba el actualizador de cach\u00e9 DFS. Se ha establecido que las sesiones root de DFS tengan la misma duraci\u00f3n que las tcons de DFS para evitar el error de use-after-free en el actualizador de cach\u00e9 DFS y en otros lugares que requieren que los IPC obtengan nuevas referencias DFS. Adem\u00e1s, se ha eliminado la gesti\u00f3n de grupos de montaje en la cach\u00e9 DFS, ya que ya no es necesaria. Esto corrige el siguiente error de use-after-free detectado por KASAN [379.946955] ERROR: KASAN: use-after-free en __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [379.947642] Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888018f57030 por la tarea kworker/u4:3/56 [379.948096] [379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 No contaminado 6.2.0-rc7-lku #23 [379.948661] Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 01/04/2014 [ 379.949368] Cola de trabajo: cifs-dfscache refresh_cache_worker [cifs] [ 379.949942] Rastreo de llamadas: [ 379.950113]  [ 379.950260] dump_stack_lvl+0x50/0x67 [ 379.950510] print_report+0x16a/0x48e [ 379.950759] ? __virt_addr_valid+0xd8/0x160 [ 379.951040] ? __phys_addr+0x41/0x80 [379.951285] kasan_report+0xdb/0x110 [379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs] [379.953637] ? __pfx___mutex_lock+0x10/0x10 [ 379.953915] ? lock_release+0xb6/0x720 [ 379.954167] ? __pfx_lock_acquire+0x10/0x10 [ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs] [ 379.954960] ? __pfx_wb_workfn+0x10/0x10 [ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs] [ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs] [ 379.956323] ? __pfx_lock_acquired+0x10/0x10 [ 379.956615] ? read_word_at_a_time+0xe/0x20 [ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220 [ 379.957235] process_one_work+0x535/0x990 [ 379.957509] ? __pfx_process_one_work+0x10/0x10 [ 379.957812] ? bloqueo_adquirido+0xb7/0x5f0 [ 379.958069] ? __lista_add_valid+0x37/0xd0 [ 379.958341] ? __lista_add_valid+0x37/0xd0 [ 379.958611] subproceso_de_trabajo+0x8e/0x630 [ 379.958861] ? __pfx_subproceso_de_trabajo+0x10/0x10 [ 379.959148] kthread+0x17d/0x1b0 [ 379.959369] ? __pfx_kthread+0x10/0x10 [379.959630] ret_from_fork+0x2c/0x50 [379.959879] \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/cifs/cifs_fs_sb.h\",\"fs/cifs/cifsglob.h\",\"fs/cifs/connect.c\",\"fs/cifs/dfs.c\",\"fs/cifs/dfs.h\",\"fs/cifs/dfs_cache.c\",\"fs/cifs/dfs_cache.h\",\"fs/cifs/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6916881f443f67f6893b504fa2171468c8aed915\",\"lessThan\":\"5a89d81c1a3c152837ea204fd29572228e54ce0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6916881f443f67f6893b504fa2171468c8aed915\",\"lessThan\":\"396935de145589c8bfe552fa03a5e38604071829\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/cifs/cifs_fs_sb.h\",\"fs/cifs/cifsglob.h\",\"fs/cifs/connect.c\",\"fs/cifs/dfs.c\",\"fs/cifs/dfs.h\",\"fs/cifs/dfs_cache.c\",\"fs/cifs/dfs_cache.h\",\"fs/cifs/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.8\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.2.8\",\"matchCriteriaId\":\"4011EC6B-7786-4709-B765-186FA31D6F7F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8E3B0E8-FA27-4305-87BB-AF6C25B160CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A47F0FC3-CE52-4BA1-BA51-22F783938431\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/396935de145589c8bfe552fa03a5e38604071829\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5a89d81c1a3c152837ea204fd29572228e54ce0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:21:29+00:00",
      "cve": "CVE-2023-53052",
      "id": "CVE-2023-53052",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "112",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cifs: fix use-after-free bug in refresh_cache_worker()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53052.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T01:05:23Z",
      "cve": "CVE-2023-53052",
      "id": "CVE-2023-53052",
      "initial_release_date": "2025-05-03T02:51:37Z",
      "product_status:known_affected": "339",
      "product_status:known_not_affected": "271",
      "product_status:recommended": "310",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53052",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53052.json",
      "version": "39"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.