CVE-2024-53176 - How a Linux Kernel CIFS Unmount Bug Could Crash Your System
There is a recently patched vulnerability in the Linux kernel’s CIFS/SMB filesystem code — CVE-2024-53176 — that caused kernel panics during unmount operations. If you use CIFS/SMB shares on your Linux systems, this is a must-read.
This post will explain in plain language what went wrong, how it happened, and how the Linux kernel now fixes it. I'll also show you some code, how the original bug could potentially be triggered, and give you links for further research.
What is the Problem?
When you unmount a CIFS (SMB) network share, the kernel is supposed to clean up everything it was using — including cached directory *dentries* (directory entries). However, there was a nasty race condition:
- Different threads could still be using or cleaning up *cached directory instances (cfids)* while unmounting.
This could cause debug output like
BUG: Dentry ffff88814f37e358{i=100000000008,n=/} still in use (2) [unmount of cifs cifs]
VFS: Busy inodes after unmount of cifs (cifs)
------------[ cut here ]------------
kernel BUG at fs/super.c:661!
When the kernel sees that dentries are still in use after unmounting, it triggers a fatal BUG and can crash the whole system! For file servers or desktops with CIFS mounts, this could lead to unexpected downtime.
Without getting too deep, here’s what happens
- The unmount routine (cifs_kill_sb()) runs, attempting to clean up all cached dir instances (close_all_cached_dirs()).
- Meanwhile, other parts of the kernel (like handling lease breaks, SMB server reconnections, or internal cleanup threads) might be cleaning up their own cached directory files (cfids).
- The directory instances (cfids) are removed from kernel tracking lists, but their data structures might live for some brief period later (use-after-remove).
- The unmount routine and these other threads could *step on each other’s toes*, so some resources (dentries) didn't get dropped.
In short: Unmount could happen *while* other cleanup is running!
---
Work Queues for Safe Cleanup:
- Instead of cleaning up immediately (and potentially racing with other threads), the kernel now uses a *global work queue* (cfid_put_wq) to drop dentries safely.
Whenever a cached dir needs cleaning, it gets queued for cleanup work.
- The unmount routine flushes this queue, making sure everything really gets dropped, before finishing the unmount.
Proper Locking:
- The fix also adds *locking* to the unmount and cleanup routines, to make sure data structures aren’t modified by multiple threads at once.
Reference in the official patch
- Linus Torvalds’ Linux kernel commit (Patch 1/1)
Before the Patch
// Thread 1: Unmount
cifs_kill_sb()
{
close_all_cached_dirs(); // Drops all cached dir dentries
}
// Thread 2: Lease break or server reconnect
invalidate_all_cached_dirs()
{
remove cfid from list;
// Might not drop dentry here in some cases!
}
// Bugs: At unmount, some dentries left over -> crash!
After the Patch
// When cleaning up a cached dir (cfid)
queue_work(cfid_put_wq, drop_cfid_dentry_work);
// Unmount thread
cifs_kill_sb()
{
close_all_cached_dirs(); // Queues up all pending dentry drops
flush_workqueue(cfid_put_wq); // Waits for all drops to complete
}
// Now: No dentries left behind!
---
How Could an Attacker Exploit This?
While CVE-2024-53176 is not a remote code execution issue, it could be used for a local denial-of-service attack:
- Any local user with permission to mount and unmount CIFS shares could potentially *trigger* the bug by rapidly mounting/unmounting shares while provoking lease breaks or server disconnects.
The resulting *kernel crash* would bring down the whole machine, causing loss of service.
If you run Samba/SMB volumes on Linux (as desktop mounts or file servers), you should patch to avoid accidental or malicious system panics.
Key Takeaways
- CVE-2024-53176 allowed unmount of a CIFS share to leave behind "dangling" in-use cache objects, crashing the Linux VFS.
Could be abused locally to crash a system (DoS).
- Patch ASAP: See the kernel commit for full details.
References
- Linux Kernel Patch (lore.kernel.org)
- CVE Details Page
- Linux CIFS VFS Documentation
Final Words
If you use the CIFS/SMB filesystem on Linux, running older kernels could put your system at risk of unexpected crashes during unmount. Patch your kernel if you haven’t already. As always, keep an eye on your logs, and follow upstream kernel mailing lists for these critical fixes.
Need help mitigating this bug or want to know if you're affected? Feel free to reach out with questions. Stay safe and happy (un)mounting! 🚀
Timeline
Published on: 12/27/2024 14:15:24 UTC
Last modified on: 05/04/2025 09:54:58 UTC