Review reviewCritical

CVE-2023-54280

Linux

In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential race when tree connecting ipc Protect access of TCP_Server_Info::hostname when building the ipc tree name as it might get freed in cifsd thread and thus causing an use-after-free bug in __tree_connect_dfs_target(). Also, while at it, update status of IPC tcon on success and then avoid any extra tree connects.

CVSS: 9.8
EPSS: 0.45%
CISA KEV: Not listed
Published: 2025.12.30

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.45%

Technical severityCVSS 9.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= c88f7dcd6d6429197fc2fd87b54a894ffcd48e8e < 536ec71ba060a02fabe8e22cecb82fe7b3a8708b, >= c88f7dcd6d6429197fc2fd87b54a894ffcd48e8e < 553476df55a111e6a66ad9155256aec0ec1b7ad0, >= c88f7dcd6d6429197fc2fd87b54a894ffcd48e8e < ee20d7c6100752eaf2409d783f4f1449c29ea33d, >= 81d583baa5f1abd73c755ce1992929debd20b687, >= 5.15.81 < 5.16, >= 5.16
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: Not available