CVE-2023-53593: cifs: Release folio lock on fscache read hit.
In the Linux kernel, the following vulnerability has been resolved:
cifs: Release folio lock on fscache read hit.
Under the current code, when cifs_readpage_worker is called, the call
contract is that the callee should unlock the page. This is documented
in the read_folio section of Documentation/filesystems/vfs.rst as:
> The filesystem should unlock the folio once the read has completed,
> whether it was successful or not.
Without this change, when fscache is in use and cache hit occurs during
a read, the page lock is leaked, producing the following stack on
subsequent reads (via mmap) to the page:
$ cat /proc/3890/task/12864/stack
[<0>] folio_wait_bit_common+0x124/0x350
[<0>] filemap_read_folio+0xad/0xf0
[<0>] filemap_fault+0x8b1/0xab0
[<0>] __do_fault+0x39/0x150
[<0>] do_fault+0x25c/0x3e0
[<0>] __handle_mm_fault+0x6ca/0xc70
[<0>] handle_mm_fault+0xe9/0x350
[<0>] do_user_addr_fault+0x225/0x6c0
[<0>] exc_page_fault+0x84/0x1b0
[<0>] asm_exc_page_fault+0x27/0x30
This requires a reboot to resolve; it is a deadlock.
Note however that the call to cifs_readpage_from_fscache does mark the
page clean, but does not free the folio lock. This happens in
__cifs_readpage_from_fscache on success. Releasing the lock at that
point however is not appropriate as cifs_readahead also calls
cifs_readpage_from_fscache and *does* unconditionally release the lock
after its return. This change therefore effectively makes
cifs_readpage_worker work like cifs_readahead.
Security readout for executives and security teams
Plain-English summary
CVE-2023-53593 is a Linux kernel CIFS file-sharing bug where a cached read can leave a memory page locked. Affected systems may deadlock on later reads and require a reboot. The available sources do not show code execution, data theft, or active exploitation.
Executive priority
Treat as a targeted operational reliability issue. Prioritize patching on file-sharing clients and servers where CIFS workloads affect business continuity, but do not classify it as an emergency without local exposure evidence.
Technical view
In cifs_readpage_worker, a successful FS-Cache read hit did not release the folio lock, violating the VFS read_folio contract. Later mmap reads can block in filemap fault paths. Kernel stable commits change the worker behavior to release the lock consistently with cifs_readahead.
Likely exposure
Exposure is most likely on Linux systems using CIFS/SMB mounts with FS-Cache enabled. The CVE record identifies Linux kernel versions and stable commits, but distro package mapping must be confirmed with vendor advisories.
Exploitation context
The source describes a reliability deadlock triggered by a CIFS cached read path. CISA KEV is false in the bundle, and no cited source reports public exploitation. Practical impact appears to be denial of service requiring reboot.
Researcher notes
Key condition is an FS-Cache hit through cifs_readpage_worker, followed by later reads such as mmap faults waiting on the leaked folio lock. The bundle lacks CVSS, CWE, exploit reports, and complete distro-specific fixed-version data.
Mitigation direction
Apply Linux kernel vendor updates containing the referenced stable CIFS fixes.
Map distribution kernel packages to the fixed upstream stable commits.
Prioritize hosts using CIFS mounts with FS-Cache enabled.
If patches are unavailable, follow vendor guidance before changing CIFS or FS-Cache behavior.
Validation and detection
Inventory Linux hosts with CIFS/SMB mounts and FS-Cache usage.
Check running kernel versions against distro advisories and upstream fixed commits.
Review kernel logs and blocked task reports for CIFS or filemap fault deadlocks.
Confirm patched kernels include the referenced cifs_readpage_worker lock release change.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-53593 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
4Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Oct 4, 2025, 15:44 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.