CVE-2023-32254

What it actually does

Race condition due to missing locking during SMB2_TREE_DISCONNECT command processing in ksmbd allows an attacker to corrupt kernel objects and execute arbitrary code with kernel privileges.

Why it matters to the business

Remote attackers can gain full control of Linux systems running the in-kernel SMB server, leading to data theft, system takeover, and potential lateral movement across the network.

How an attack unfolds

An unauthenticated remote attacker sends a rapid sequence of SMB2_TREE_DISCONNECT commands over the network while a concurrent operation manipulates the same tree connection object; the absent lock allows the attacker to trigger a use-after-free or similar race that redirects kernel execution to attacker-controlled code.

How to fix it

Upgrade the Linux kernel to a version containing commit 5729a900a07b7f166b94577c543d44c4c42e5ec3 or later; disable ksmbd if the service is not required.

How to confirm the fix worked

Verify the running kernel contains commit 5729a900a07b7f166b94577c543d44c4c42e5ec3 or a later equivalent; review ksmbd configuration to confirm the module is either absent or updated.

Typical attack path

1. Establish an SMB connection to a target ksmbd instance
2. Issue multiple concurrent SMB2_TREE_DISCONNECT requests
3. Trigger the race window to corrupt kernel structures
4. Execute arbitrary kernel code to install a rootkit or exfiltrate data

How to detect it

Review kernel logs and SMB audit trails for repeated or malformed TREE_DISCONNECT requests from the same session; look for unexpected kernel oops or use-after-free warnings coinciding with SMB activity.

What your security team should do

• Apply the referenced kernel commit or a distribution backport immediately on all systems exposing ksmbd
• Disable the ksmbd module unless SMB serving from kernel space is explicitly required
• Monitor for new public exploits given the high CVSS and network attack vector