Linux Kernel ksmbd: NPE via invalid SMB2 compound session
CVE-2026-53383 Published on July 19, 2026
ksmbd: reject non-VALID session in compound request branch
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reject non-VALID session in compound request branch
smb2_check_user_session() takes a shortcut for any operation that is not
the first in a COMPOUND request: it reuses work->sess (the session bound by
the first operation) and validates only the SessionId, then returns
"valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a
SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation
value) skips even the id comparison. The standalone path
(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does
enforce the VALID state; the compound branch bypasses all of it.
A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes
a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL
(->user is assigned later, by ntlm_authenticate()). Used as operation 1 of
a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,
\\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and
reaches ksmbd_ipc_tree_connect_request(), which dereferences
user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704)
-> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd
worker for all clients.
Reject any non-first compound operation that lands on a session which is
not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path
enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session,
but it is never carried as a non-first compound operation, so multi-leg
authentication is unaffected by this check.
Products Associated with CVE-2026-53383
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version eb947403518ea3d93f6d89264bb1f5416bb0c7d0 and below 25ff12b82a376ff5c4583102a63d2456a6b9ebb9 is affected.
- Version 854156d12caa9d36de1cf5f084591c7686cc8a9d and below fc578523a72cb8b329d32070b95898e81613cc3f is affected.
- Version 5005bcb4219156f1bf7587b185080ec1da08518e and below d2bbbb6c55812220fee5d801c275cc267ea3cbeb is affected.
- Version 5005bcb4219156f1bf7587b185080ec1da08518e and below 8f0302fb691537d33ec8f668565257ea9d340ffe is affected.
- Version 5005bcb4219156f1bf7587b185080ec1da08518e and below 7cad3ceaf679c55bc9946685dacafce78ce6b51a is affected.
- Version 5005bcb4219156f1bf7587b185080ec1da08518e and below 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7 is affected.
- Version 5005bcb4219156f1bf7587b185080ec1da08518e and below 5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4 is affected.
- Version 5005bcb4219156f1bf7587b185080ec1da08518e and below 609ca17d869d04ba249e32cdcbf13c0b1c66f43c is affected.
- Version d1066c1b3663401cd23c0d6e60cdae750ce00c0f is affected.
- Version 5.15.121 and below 5.15.211 is affected.
- Version 6.1.36 and below 6.1.177 is affected.
- Version 6.3.10 and below 6.4 is affected.
- Version 6.4 is affected.
- Before 6.4 is unaffected.
- Version 5.15.211, <= 5.15.* is unaffected.
- Version 6.1.177, <= 6.1.* is unaffected.
- Version 6.6.144, <= 6.6.* is unaffected.
- Version 6.12.95, <= 6.12.* is unaffected.
- Version 6.18.37, <= 6.18.* is unaffected.
- Version 7.0.14, <= 7.0.* is unaffected.
- Version 7.1.2, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.