What is the CVSS score of CVE-2024-53177?

CVE-2024-53177 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2024-53177?

A critical kernel vulnerability in Linux SMB/CIFS (CVE-2024-53177) enables memory corruption when systems mount SMB shares from a compromised or untrusted server, risking denial of service or system…. A patch is available.

How to fix or mitigate CVE-2024-53177?

Within 24 hours, inventory Linux systems running SMB/CIFS mounts by executing `lsmod | grep cifs` on relevant servers, document your Linux distribution and kernel versions, and confirm patch availability from your vendor's security advisory. Within 7 days, test available vendor-released patches in a staging environment that mirrors production SMB configurations and validate share connectivity post-patch, then schedule production deployments through your standard change management process. Within 30 days, complete all production patching, verify updated kernel versions via compliance auditing tools, and formally document any intentionally unpatched systems with business and security leadership risk acceptance.

Linux Kernel CVE-2024-53177

CRITICAL

Use After Free (CWE-416)

2024-12-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Use After Free Memory Corruption Code Injection VMware Linux

9.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Attacker acts as a network SMB server (AV:N) but must win a lease-break race (AC:H) after the victim mounts the hostile share (UI:R); kernel UAF yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 11:29 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 11:23 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 11:23 NVD

HIGH CRITICAL

CVSS changed

Aug 04, 2026 - 11:23 NVD

7.8 (HIGH) 9.8 (CRITICAL)

CVE Published

Dec 27, 2024 - 14:15 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: prevent use-after-free due to open_cached_dir error paths

If open_cached_dir() encounters an error parsing the lease from the server, the error handling may race with receiving a lease break, resulting in open_cached_dir() freeing the cfid while the queued work is pending.

Update open_cached_dir() to drop refs rather than directly freeing the cfid.

Have cached_dir_lease_break(), cfids_laundromat_worker(), and invalidate_all_cached_dirs() clear has_lease immediately while still holding cfids->cfid_list_lock, and then use this to also simplify the reference counting in cfids_laundromat_worker() and invalidate_all_cached_dirs().

Fixes this KASAN splat (which manually injects an error and lease break in open_cached_dir()):

============== BUG: KASAN: slab-use-after-free in smb2_cached_lease_break+0x27/0xb0 Read of size 8 at addr ffff88811cc24c10 by task kworker/3:1/65

CPU: 3 UID: 0 PID: 65 Comm: kworker/3:1 Not tainted 6.12.0-rc6-g255cf264e6e5-dirty #87 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Workqueue: cifsiod smb2_cached_lease_break Call Trace: <TASK> dump_stack_lvl+0x77/0xb0 print_report+0xce/0x660 kasan_report+0xd3/0x110 smb2_cached_lease_break+0x27/0xb0 process_one_work+0x50a/0xc50 worker_thread+0x2ba/0x530 kthread+0x17c/0x1c0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 </TASK>

Allocated by task 2464: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 open_cached_dir+0xa7d/0x1fb0 smb2_query_path_info+0x43c/0x6e0 cifs_get_fattr+0x346/0xf10 cifs_get_inode_info+0x157/0x210 cifs_revalidate_dentry_attr+0x2d1/0x460 cifs_getattr+0x173/0x470 vfs_statx_path+0x10f/0x160 vfs_statx+0xe9/0x150 vfs_fstatat+0x5e/0xc0 __do_sys_newfstatat+0x91/0xf0 do_syscall_64+0x95/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Freed by task 2464: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x51/0x70 kfree+0x174/0x520 open_cached_dir+0x97f/0x1fb0 smb2_query_path_info+0x43c/0x6e0 cifs_get_fattr+0x346/0xf10 cifs_get_inode_info+0x157/0x210 cifs_revalidate_dentry_attr+0x2d1/0x460 cifs_getattr+0x173/0x470 vfs_statx_path+0x10f/0x160 vfs_statx+0xe9/0x150 vfs_fstatat+0x5e/0xc0 __do_sys_newfstatat+0x91/0xf0 do_syscall_64+0x95/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Last potentially related work creation: kasan_save_stack+0x33/0x60 __kasan_record_aux_stack+0xad/0xc0 insert_work+0x32/0x100 __queue_work+0x5c9/0x870 queue_work_on+0x82/0x90 open_cached_dir+0x1369/0x1fb0 smb2_query_path_info+0x43c/0x6e0 cifs_get_fattr+0x346/0xf10 cifs_get_inode_info+0x157/0x210 cifs_revalidate_dentry_attr+0x2d1/0x460 cifs_getattr+0x173/0x470 vfs_statx_path+0x10f/0x160 vfs_statx+0xe9/0x150 vfs_fstatat+0x5e/0xc0 __do_sys_newfstatat+0x91/0xf0 do_syscall_64+0x95/0x1a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

The buggy address belongs to the object at ffff88811cc24c00 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 16 bytes inside of freed 1024-byte region [ffff88811cc24c00, ffff88811cc25000)

AnalysisAI

Kernel memory corruption (use-after-free) in the Linux kernel's SMB/CIFS client (fs/smb/client, the cifs module) lets a race between open_cached_dir() error handling and an incoming server lease break free a cached directory (cfid) object while queued work still references it. Systems mounting SMB shares are affected; an attacker positioned as (or controlling) the SMB server can corrupt kernel memory, enabling denial of service and potentially kernel-level code execution. There is no public exploit identified at time of analysis, and EPSS is low (0.23%, 14th percentile), consistent with a hard-to-trigger race rather than a widely weaponized flaw.

Technical ContextAI

The affected component is the in-kernel SMB3/CIFS network filesystem client (fs/smb/client). When a directory is opened, the client can cache the handle and hold an SMB lease on it; lease breaks from the server are processed asynchronously via workqueue callbacks (smb2_cached_lease_break / cifsiod). The bug is a CWE-416 use-after-free: if open_cached_dir() fails while parsing the lease response, its error path frees the cfid structure directly, but a concurrently received lease break can already have queued work referencing that same cfid, so the worker later reads freed slab memory (observed as a KASAN slab-use-after-free in the kmalloc-1k cache). The fix converts direct kfree() into reference-count drops and clears has_lease under cfids->cfid_list_lock in cached_dir_lease_break(), cfids_laundromat_worker(), and invalidate_all_cached_dirs(), closing the race. Per the CPE data the scope is the Linux kernel itself (cpe:2.3:o:linux:linux_kernel), across the stable branches that received the four backport commits.

RemediationAI

Patch available per vendor advisory: update to a Linux kernel build that includes the fix commits at https://git.kernel.org/stable/c/47655a12c6b1bca8fa230085eab2e85a076932b7 , https://git.kernel.org/stable/c/791f833053578b9fd24252ebb7162a61bc3f805b , https://git.kernel.org/stable/c/97e2afcac0bebfef6a5360f4267ce4c44507b845 , and https://git.kernel.org/stable/c/a9685b409a03b73d2980bbfa53eb47555802d0a9 , or the corresponding fixed package from your distribution and reboot. If immediate patching is not possible, reduce exposure by not mounting SMB/CIFS shares from untrusted or attacker-controllable servers and by restricting outbound SMB (TCP 445) to known, trusted file servers; where the CIFS client is unused, unloading or blacklisting the cifs kernel module eliminates the attack surface entirely, with the trade-off that SMB share mounting will no longer function. These controls limit exposure but do not fix the underlying race, so schedule the kernel update.