High 7.8Published Dec 24, 2025

CVE-2023-53990SMB3: Add missing locks to protect deferred close file list

Updated under an hour ago (Oct 29, 2026, 3:30 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: SMB3: Add missing locks to protect deferred close file list cifs_del_deferred_close function has a critical section which modifies the deferred close file list. We must acquire deferred_lock before calling cifs_del_deferred_close function.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	860efae127888ae535bc4eda1b7f27642727c69e builds before 0f87e18203bd30f71eb1a65259e28e291b6cc43a; from ca08d0eac020d48a3141dbec0a3cf64fbdb17cde before 3aa9d065b0685b4e6052f3f2a2462966fdc44fd2; from ca08d0eac020d48a3141dbec0a3cf64fbdb17cde before cb36365dac25d546ca4af0eb22acb43c9b4ddfdf; from ca08d0eac020d48a3141dbec0a3cf64fbdb17cde before 32a046ccaeea6c19965c04a4c521e703f6607924; from ca08d0eac020d48a3141dbec0a3cf64fbdb17cde before ab9ddc87a9055c4bebd6524d5d761d605d52e557; 60b6d38add7b9c17d6e5d49ee8e930ea1a5650c5; from 5.15.63 before 5.15.111; from 5.19.4 before 5.20	CNA record

References

References

https://git.kernel.org/stable/c/0f87e18203bd30f71eb1a65259e28e291b6cc43a
https://git.kernel.org/stable/c/3aa9d065b0685b4e6052f3f2a2462966fdc44fd2
https://git.kernel.org/stable/c/cb36365dac25d546ca4af0eb22acb43c9b4ddfdf
https://git.kernel.org/stable/c/32a046ccaeea6c19965c04a4c521e703f6607924
https://git.kernel.org/stable/c/ab9ddc87a9055c4bebd6524d5d761d605d52e557

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.