---
id: CVE-2024-53179
title: 'smb: client: fix use-after-free of signing key'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix use-after-free of signing key

  Customers have reported use-after-free in @ses->auth_key.response with
  SMB2.1 + sign mounts which occurs due to followin…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 <
    0944c2596c2a3442735b5bb6714a17a16188a68f
  - >-
    Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 <
    39619c65ab4bbb3e78c818f537687653e112764d
  - >-
    Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 <
    0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591
  - >-
    Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 <
    343d7fe6df9e247671440a932b6a73af4fa86d95
  - Linux 3.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2025-02-10T17:13:09.010478Z'
published: '2024-12-27'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:20:09.698Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-53179'
references:
  - url: 'https://git.kernel.org/stable/c/0944c2596c2a3442735b5bb6714a17a16188a68f'
  - url: 'https://git.kernel.org/stable/c/39619c65ab4bbb3e78c818f537687653e112764d'
  - url: 'https://git.kernel.org/stable/c/0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591'
  - url: 'https://git.kernel.org/stable/c/343d7fe6df9e247671440a932b6a73af4fa86d95'
tags:
  - cve.org
epss: 0.00617
epssPercentile: 0.49868
ingestedAt: '2026-11-03T14:47:02.520Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix use-after-free of signing key

Customers have reported use-after-free in @ses->auth_key.response with
SMB2.1 + sign mounts which occurs due to following race:

task A                         task B
cifs_mount()
 dfs_mount_share()
  get_session()
   cifs_mount_get_session()    cifs_send_recv()
    cifs_get_smb_ses()          compound_send_recv()
     cifs_setup_session()        smb2_setup_request()
      kfree_sensitive()           smb2_calc_signature()
                                   crypto_shash_setkey() *UAF*

Fix this by ensuring that we have a valid @ses->auth_key.response by
checking whether @ses->ses_status is SES_GOOD or SES_EXITING with
@ses->ses_lock held.  After commit 24a9799aa8ef ("smb: client: fix UAF
in smb2_reconnect_server()"), we made sure to call ->logoff() only
when @ses was known to be good (e.g. valid ->auth_key.response), so
it's safe to access signing key when @ses->ses_status == SES_EXITING.

## Affected

- `Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 0944c2596c2a3442735b5bb6714a17a16188a68f`
- `Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 39619c65ab4bbb3e78c818f537687653e112764d`
- `Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 0e2b654a3848bf9da3b0d54c1ccf3f1b8c635591`
- `Linux >= 32811d242ff6f28da2ab18c90a15e32fd958e774 < 343d7fe6df9e247671440a932b6a73af4fa86d95`
- `Linux 3.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.