TCP Timers Deadlock in Linux Kernel's SMB Client

CVE-2024-54680

Summary

The Linux kernel's SMB client has a vulnerability that can lead to a TCP timers deadlock when the cifs module is unloaded. This issue arises from improperly managing socket reference counting, specifically with the sk->sk_net_refcnt value. When this value is set manually after socket creation, it prevents the TCP timers from being cleared upon closing the socket. Consequently, this can result in a lock dependency warning and potential system deadlock. The fix requires adhering to proper socket internals handling without manual interference with network namespace reference counts.

References