CVE-2024-53176

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The teardown side of the race is driven entirely by SMB traffic from the remote server over TCP/445 — an unsolicited SMB2 lease-break packet reaches `cached_dir_lease_break()` from `cifs_demultiplex_thread()`, and a dropped connection or `STATUS_NETWORK_NAME_DELETED` forces `invalidate_all_cached_dirs()`. A malicious, compromised, DFS-redirected, or on-path SMB server thus triggers the vulnerable window remotely.

AC:LAttack complexity, low

The attacker fully controls one side of the race and can hold it open indefinitely — flooding lease breaks for every cached dir (default up to `max_cached_dirs`) or keeping the client in a reconnect loop leaves cfids off `cfids->entries` with dentries still held for a workqueue round-trip, while the unmount side is a routine, endlessly repeated event (autofs/systemd idle unmounts, container teardown, shutdown). No memory grooming, no non-default config (`dir_cache_timeout` defaults to 30), and unlimited retries across every client.

PR:NPrivileges required, none

The malicious SMB server needs no credentials or privileges on the victim client; the client authenticates to the server, not the reverse, and lease-break frames are processed by the demux thread with no client-side authorization. Without enforced signing an off-path/on-path attacker can inject the break frames just as well.

UI:NUser interaction, none

No victim action is needed — the mount pre-exists, lease breaks and reconnect-driven invalidation are handled automatically by the kernel, and the racing unmount occurs unattended via automount idle timeouts, container/pod teardown, or system shutdown.

S:UScope, unchanged

The corruption is confined to the cifs client's own kernel objects (cached_fid, dentry, superblock) within the kernel's security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

The unlocked walk of `cfids->entries` races with `list_del()` plus `kfree(cfid)` in `free_cached_dir()`, so the unmount path dereferences a freed (and potentially reallocated) cached_fid and follows attacker-influenced pointers; combined with the dentry refcount underflow from the double `dput()`, this yields a use-after-free on dentry-cache objects leveragable for kernel memory disclosure.

I:HIntegrity impact, high

The race produces a double `dput()` of the same `cfid->dentry` (the fix adds `fid_lock` around every read/clear of it), underflowing the dentry lockref and freeing a live dentry — a classic UAF write primitive via the dentry slab and its `d_op` vtable — plus a NULL store into an already-freed cached_fid object.

A:HAvailability impact, high

The reported outcome is an outright kernel BUG — "Dentry still in use", "VFS: Busy inodes after unmount", and `BUG at fs/super.c` via `CHECK_DATA_CORRUPTION` — with surviving inodes poisoned by `VFS_PTR_POISON` and deferred `dput()`s touching a freed superblock, guaranteeing a panic or later oops.