LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53246: cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL

In the Linux kernel, the following vulnerability has been resolved: cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to S_AUTOMOUNT and corresponding dentry flags is retained regardless of CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in VFS follow_automount() when traversing a DFS referral link: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> __traverse_mounts+0xb5/0x220 ? cifs_revalidate_mapping+0x65/0xc0 [cifs] step_into+0x195/0x610 ? lookup_fast+0xe2/0xf0 path_lookupat+0x64/0x140 filename_lookup+0xc2/0x140 ? __create_object+0x299/0x380 ? kmem_cache_alloc+0x119/0x220 ? user_path_at_empty+0x31/0x50 user_path_at_empty+0x31/0x50 __x64_sys_chdir+0x2a/0xd0 ? exit_to_user_mode_prepare+0xca/0x100 do_syscall_64+0x42/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This approach was chosen as it provides more control over the error path.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can cause a system fault when a CIFS/SMB client follows a DFS referral while the kernel was built without DFS upcall support. Business impact is primarily availability, not confirmed data theft or remote code execution, based on the provided sources.

Executive priority

Prioritize patching systems that rely on SMB/CIFS file shares, especially where DFS referrals are used. Treat this as an availability risk requiring normal kernel maintenance urgency unless vendor advisories identify higher impact.

Technical view

In cifs.ko, DFS referral attributes could still set automount-related flags when CONFIG_CIFS_DFS_UPCALL was disabled. Because cifs_dfs_d_automount was NULL, VFS follow_automount could dereference a null pointer during DFS traversal. The fix adds a fallback handler returning -EREMOTE.

Likely exposure

Exposure is likely limited to Linux systems with affected kernel versions, the CIFS client in use, DFS referral traversal, and CONFIG_CIFS_DFS_UPCALL disabled. Systems not mounting CIFS/SMB shares or not encountering DFS referrals are less likely exposed.

Exploitation context

The bundle provides no KEV listing, exploit report, CVSS score, or public weaponization evidence. It describes a reproducible kernel oops condition during filesystem traversal, but does not establish active exploitation or a remotely triggerable attack path.

Researcher notes

The affected condition depends on a compile-time option and runtime CIFS DFS traversal behavior. The source does not provide CVSS, CWE, privilege requirements, or proof of active exploitation, so impact and reach should be validated against distribution advisories and local kernel configuration.

Mitigation direction

  • Update to a kernel containing the referenced stable CIFS fixes.
  • Check distribution kernel advisories for backported fixes for CVE-2023-53246.
  • Review whether CIFS/SMB mounts using DFS referrals are required.
  • Where feasible, avoid affected CIFS DFS referral paths until patched.
  • Confirm kernel configuration for CONFIG_CIFS_DFS_UPCALL on exposed systems.

Validation and detection

  • Inventory Linux kernels and identify versions matching vendor affected guidance.
  • Check whether the CIFS kernel module is loaded or CIFS mounts exist.
  • Determine whether mounted SMB paths use DFS referrals.
  • Review kernel build configuration for CONFIG_CIFS_DFS_UPCALL.
  • Confirm the stable fix commit or distribution backport is present.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53246 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux25e195aa1e607f129ab912d29fcfc79239703307, 25e195aa1e607f129ab912d29fcfc79239703307, 25e195aa1e607f129ab912d29fcfc79239703307, 25e195aa1e607f129ab912d29fcfc79239703307, 25e195aa1e607f129ab912d29fcfc79239703307unaffected
LinuxLinux5.7, 0, 5.10.177, 5.15.106, 6.1.23, 6.2.10, 6.3affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.