LiveActive security incident?Get immediate response
CVE Record

CVE-2023-53593: cifs: Release folio lock on fscache read hit.

In the Linux kernel, the following vulnerability has been resolved: cifs: Release folio lock on fscache read hit. Under the current code, when cifs_readpage_worker is called, the call contract is that the callee should unlock the page. This is documented in the read_folio section of Documentation/filesystems/vfs.rst as: > The filesystem should unlock the folio once the read has completed, > whether it was successful or not. Without this change, when fscache is in use and cache hit occurs during a read, the page lock is leaked, producing the following stack on subsequent reads (via mmap) to the page: $ cat /proc/3890/task/12864/stack [<0>] folio_wait_bit_common+0x124/0x350 [<0>] filemap_read_folio+0xad/0xf0 [<0>] filemap_fault+0x8b1/0xab0 [<0>] __do_fault+0x39/0x150 [<0>] do_fault+0x25c/0x3e0 [<0>] __handle_mm_fault+0x6ca/0xc70 [<0>] handle_mm_fault+0xe9/0x350 [<0>] do_user_addr_fault+0x225/0x6c0 [<0>] exc_page_fault+0x84/0x1b0 [<0>] asm_exc_page_fault+0x27/0x30 This requires a reboot to resolve; it is a deadlock. Note however that the call to cifs_readpage_from_fscache does mark the page clean, but does not free the folio lock. This happens in __cifs_readpage_from_fscache on success. Releasing the lock at that point however is not appropriate as cifs_readahead also calls cifs_readpage_from_fscache and *does* unconditionally release the lock after its return. This change therefore effectively makes cifs_readpage_worker work like cifs_readahead.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-53593 is a Linux kernel CIFS file-sharing bug where a cached read can leave a memory page locked. Affected systems may deadlock on later reads and require a reboot. The available sources do not show code execution, data theft, or active exploitation.

Executive priority

Treat as a targeted operational reliability issue. Prioritize patching on file-sharing clients and servers where CIFS workloads affect business continuity, but do not classify it as an emergency without local exposure evidence.

Technical view

In cifs_readpage_worker, a successful FS-Cache read hit did not release the folio lock, violating the VFS read_folio contract. Later mmap reads can block in filemap fault paths. Kernel stable commits change the worker behavior to release the lock consistently with cifs_readahead.

Likely exposure

Exposure is most likely on Linux systems using CIFS/SMB mounts with FS-Cache enabled. The CVE record identifies Linux kernel versions and stable commits, but distro package mapping must be confirmed with vendor advisories.

Exploitation context

The source describes a reliability deadlock triggered by a CIFS cached read path. CISA KEV is false in the bundle, and no cited source reports public exploitation. Practical impact appears to be denial of service requiring reboot.

Researcher notes

Key condition is an FS-Cache hit through cifs_readpage_worker, followed by later reads such as mmap faults waiting on the leaked folio lock. The bundle lacks CVSS, CWE, exploit reports, and complete distro-specific fixed-version data.

Mitigation direction

  • Apply Linux kernel vendor updates containing the referenced stable CIFS fixes.
  • Map distribution kernel packages to the fixed upstream stable commits.
  • Prioritize hosts using CIFS mounts with FS-Cache enabled.
  • If patches are unavailable, follow vendor guidance before changing CIFS or FS-Cache behavior.

Validation and detection

  • Inventory Linux hosts with CIFS/SMB mounts and FS-Cache usage.
  • Check running kernel versions against distro advisories and upstream fixed commits.
  • Review kernel logs and blocked task reports for CIFS or filemap fault deadlocks.
  • Confirm patched kernels include the referenced cifs_readpage_worker lock release change.
Prepared
Confidence
medium
Sources
5

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-53593 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0174ee9947bd0f24fee2794b35258960d108b7aa, 0174ee9947bd0f24fee2794b35258960d108b7aa, 0174ee9947bd0f24fee2794b35258960d108b7aaunaffected
LinuxLinux5.17, 0, 6.1.47, 6.4.12, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.