CVE-2024-54680

What it actually does

Manually setting sk_net_refcnt=1 on kernel-created TCP sockets in the SMB client prevents inet_csk_clear_xmit_timers_sync from running on close, leaving TCP timers active and causing lockdep warnings followed by deadlock on tcp_write_timer when the cifs module is unloaded.

Why it matters to the business

Unloading the SMB client module on affected Linux systems can trigger a kernel deadlock, resulting in system hangs, loss of availability for file-sharing workloads, and requiring a reboot; the issue affects Debian 13 users until the kernel is updated.

How an attack unfolds

An attacker with local access loads the cifs module, performs SMB operations that create sockets, then unloads the module; the incorrect socket reference count leaves TCP timers uncleared, leading to a deadlock seconds later. No remote code execution or privilege escalation is involved; the condition can be triggered deliberately or accidentally during module management.

How to fix it

Upgrade the Linux kernel to version 6.12.8-1 or later on Debian 13 systems. Rebuild and reboot with the fixed kernel; avoid manual rmmod of cifs until patched. The fix replaces manual sk_net_refcnt manipulation with sock_create_kern and holds an extra netns reference for server sockets.

How to confirm the fix worked

Confirm the installed kernel package version is at least 6.12.8-1, reproduce the original rmmod sequence in a test environment, and verify absence of the lockdep warning and deadlock. Check dmesg for resolved timer behavior after module unload.

Typical attack path

1. Obtain local access or script execution on a system using the cifs module
2. Ensure SMB client sockets are created via mount or connection activity
3. Execute rmmod cifs to unload the module
4. Wait for TCP timer cleanup to be skipped due to sk_net_refcnt
5. Observe lockdep warning and deadlock on tcp_write_timer

How to detect it

Search kernel logs and dmesg for lockdep warnings mentioning tcp_write_timer or sk_net_refcnt after cifs module unload events; monitor for hung tasks or unresponsive systems following rmmod operations on systems running vulnerable kernels.

What your security team should do

• Prioritize kernel upgrade to 6.12.8-1 across all Debian 13 systems using cifs
• Add monitoring for cifs module unload events in production environments
• Test module unload sequences in staging before applying to production
• Review any automated scripts that perform rmmod on the SMB client