CVE-2023-1193

What it actually does

Use-after-free in setup_async_work within the KSMBD in-kernel CIFS/SMB server implementation allows access to already-freed memory structures, resulting in a kernel crash.

Why it matters to the business

Linux systems exposing the in-kernel SMB server can experience sudden denial of service, disrupting file sharing and requiring manual recovery or reboot.

How an attack unfolds

An authenticated remote attacker sends specially crafted SMB requests that trigger the asynchronous work setup path, causing the kernel to reference memory after it has been freed and panic the system.

How to fix it

Apply the upstream fix commit 457391b0380335d5e9a5babdec90ac53928b23b4 or later; rebuild and deploy the patched kernel on all affected systems running KSMBD.

How to confirm the fix worked

Verify the running kernel contains commit 457391b0380335d5e9a5babdec90ac53928b23b4 or is built from a release that includes it; test that KSMBD no longer crashes under the triggering workload.

Typical attack path

1. Establish an authenticated SMB session to a KSMBD-enabled Linux target
2. Send crafted requests that exercise the setup_async_work code path
3. Trigger the use-after-free condition leading to kernel panic and system crash

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops/panic entries mentioning ksmbd or setup_async_work; correlate with inbound SMB traffic around the time of crashes.

What your security team should do

• Prioritize patching KSMBD-enabled systems to the fixed commit
• Disable the in-kernel KSMBD module if SMB services are not required
• Monitor kernel logs for oops and panic messages related to ksmbd