CVE-2023-52757

What it actually does

Race condition in SMB client mid release allows deadlock between cifs_demultiplex_thread and procfs debug show under nested spinlocks, with potential use-after-free on mid objects when references are mishandled.

Why it matters to the business

Linux systems using SMB file shares can experience kernel deadlocks or crashes, disrupting file access, backups, and services; older Ubuntu LTS releases remain exposed until patched.

How an attack unfolds

Local attacker triggers concurrent SMB operations and debug proc reads to acquire cifs_tcp_ses_lock and server->mid_lock in opposite order, causing deadlock or use-after-free during mid release.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.13.0-83.127 or 4.4.0-4.19, linux-aws 4.4.0-1002.2 or 4.4.0-1001.10, linux-hwe 4.8.0-36.36~16.04.1, and equivalent fixes for linux-gke, linux-raspi2, linux-snapdragon, and LTS backports.

How to confirm the fix worked

Verify running kernel version against the fixed package list for each distribution; confirm absence of the vulnerable release_mid spinlock pattern via source inspection or kpatch status.

Typical attack path

1. Obtain local shell on affected Linux kernel with SMB client loaded
2. Initiate SMB connections to trigger mid allocation in cifs_demultiplex_thread
3. Concurrently invoke cifs_debug_data_proc_show to contend on cifs_tcp_ses_lock
4. Force nested locking sequence that deadlocks or frees mid under spinlock
5. Escalate from resulting kernel panic or memory corruption to higher privileges

How to detect it

Review kernel logs for deadlock traces involving cifs_demultiplex_thread, cifs_debug_data_proc_show, and mid_lock; inspect for use-after-free reports in SMB client paths.

What your security team should do

• Immediately schedule kernel upgrades on all SMB client systems using the exact fixed versions provided
• Restrict local user access and SMB debugging interfaces until patches are deployed
• Monitor EPSS and KEV status for any future exploitation increase
• Apply defense-in-depth by disabling unnecessary procfs SMB debug entries