In the Linux kernel, the following vulnerability has been resolved:

cifs: fix session state check in reconnect to avoid use-after-free issue

Don't collect exiting session in smb2_reconnect_server(), because it
will be released soon.

Note that the exiting session will stay in server->smb_ses_list until
it complete the cifs_free_ipc() and logoff() and then delete itself
from the list.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00025.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
4fcd1813e6404dd4420c7d12fb483f9320f0bf93 affected < 7e4f5c3f01fb0e51ca438e43262d858daf9a0a76
4fcd1813e6404dd4420c7d12fb483f9320f0bf93 affected < 759ffc164d95a32c09528766d74d9b4fb054e8f4
4fcd1813e6404dd4420c7d12fb483f9320f0bf93 affected < 99f280700b4cc02d5f141b8d15f8e9fad0418f65
655e0c067f0e02ece03fd0591dabe3db2ae27552 affected —
875cc09c0767a4ac06b57af383709657f98b3ea1 affected —
599fe1409085059ba12a2c3897c853be9fa9e7cf affected —
2e4378ee60049b752c9dce16f62ce6fbd11b379a affected —
59b520454b323ec43b2ae757217332cea33091e0 affected —
e20c888e2b3576e5f498c167729d274ef60b86f8 affected —
4ce7aa4e44d88ce64ea8ae2337b8910f3670b0ba affected —
419fad68e4c4135ff9859e9214dd6cf954413ca1 affected —
Linux Linux affected
Version Status Constraints
4.7 affected —
0 unaffected < 4.7
6.1.47 unaffected ≤ 6.1.*
6.4.12 unaffected ≤ 6.4.*
6.5 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/759ffc164d95a32c09528766d74d9b4fb054e8f4 cve-icon cve-icon
https://git.kernel.org/stable/c/7e4f5c3f01fb0e51ca438e43262d858daf9a0a76 cve-icon cve-icon
https://git.kernel.org/stable/c/99f280700b4cc02d5f141b8d15f8e9fad0418f65 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025120941-CVE-2023-53794-8912@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-53794 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-53794 cve-icon
History

Wed, 10 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 09 Dec 2025 00:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list.
Title cifs: fix session state check in reconnect to avoid use-after-free issue
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-01-05T10:32:55.035Z

Reserved: 2025-12-08T23:58:35.274Z

Link: CVE-2023-53794

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-09T01:16:50.957

Modified: 2025-12-09T18:37:13.640

Link: CVE-2023-53794

cve-icon Redhat

Severity : Important

Publid Date: 2025-12-09T00:00:00Z

Links: CVE-2023-53794 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.