CVE-2023-52480

What it actually does

Race condition between ksmbd_session_lookup (xa_load) and ksmbd_expire_session / smb2_sess_setup (xa_erase + kfree) allows use-after-free on the session object, enabling writes to freed memory such as last_active.

Why it matters to the business

Systems exposing the in-kernel SMB server face kernel crashes or potential arbitrary code execution; the flaw affects dozens of common Linux distributions and long-supported kernel packages, increasing exposure surface on file servers and increasing operational risk until patched.

How an attack unfolds

An attacker with network access to the SMB port triggers concurrent session setup and expiration paths; one thread loads a session reference while another erases and frees it, allowing the first thread to dereference the freed object.

How to fix it

Upgrade the linux kernel package to a fixed version for the distribution in use (examples: Debian 11 to 5.10.46-1, Ubuntu 22.04 to 5.13.0-19.19 or 5.15.0-1019.24.1 for azure-fde, Ubuntu 20.04 HWE to 5.15.0-33.34~20.04.1). Reboot after installation. If immediate patching is impossible, disable ksmbd via module blacklist or firewall rules blocking port 445.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the fixed release for the distribution, verify ksmbd module is loaded from the updated package, and exercise SMB session creation/expiration under load to ensure no UAF-related oops occur.

Typical attack path

1. Establish TCP connection to ksmbd listener
2. Issue SMB2 negotiate and session setup requests
3. Trigger or wait for session expiration in a parallel thread
4. Perform operations that reuse the freed session structure

How to detect it

Review kernel logs for oops or warnings referencing ksmbd_session_lookup, xa_load, or use-after-free in the ksmbd module; correlate with SMB connection logs showing rapid session setup/expire sequences.

What your security team should do

• Prioritize kernel updates on all systems exposing ksmbd within the next maintenance window
• Disable ksmbd on hosts where SMB is not required
• Add kernel version checks to vulnerability scanning and asset inventory
• Monitor vendor advisories for backports to older LTS kernels still in use