CVE-2026-53383 - Vulnerability Details

- ksmbd: reject non-VALID session in compound request branch

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: reject non-VALID session in compound request branch

smb2_check_user_session() takes a shortcut for any operation that is not
the first in a COMPOUND request: it reuses work->sess (the session bound by
the first operation) and validates only the SessionId, then returns
"valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a
SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation
value) skips even the id comparison. The standalone path
(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does
enforce the VALID state; the compound branch bypasses all of it.

A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes
a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL
(->user is assigned later, by ntlm_authenticate()). Used as operation 1 of
a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,
\\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and
reaches ksmbd_ipc_tree_connect_request(), which dereferences
user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704)
-> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd
worker for all clients.

Reject any non-first compound operation that lands on a session which is
not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path
enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session,
but it is never carried as a non-first compound operation, so multi-leg
authentication is unaffected by this check.

Published: 2026-07-19

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s ksmbd SMB server, a flaw allows a remote host to send a specially crafted SMB2 compound request that bypasses session validation. Instead of verifying that the session used by later operations is in the VALID state, the kernel re‑uses the first operation’s session data and only checks the SessionId. When an operation within the compound request uses a session whose user pointer is NULL, the code dereferences that pointer, causing a null‑pointer dereference and a kernel Oops. The ksmbd worker thread is wedged, effectively disrupting the SMB service for all connecting clients.

Affected Systems

Any Linux kernel that contains the ksmbd module without the patch that adds the session‑validation check is vulnerable. No version range is listed explicitly, so any kernel release preceding the commit that introduced the fix is impacted.

Risk and Exploitability

The CV for an unprivileged remote attacker, while the EPSS score of less than 1 % indicates a very low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would normally come from a client that can reach the ksmbd service and issue a compound request carrying a session with an invalid or NULL user pointer.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`eb947403518ea3d93f6d89264bb1f5416bb0c7d0`	affected	< 25ff12b82a376ff5c4583102a63d2456a6b9ebb9
`854156d12caa9d36de1cf5f084591c7686cc8a9d`	affected	< fc578523a72cb8b329d32070b95898e81613cc3f
`5005bcb4219156f1bf7587b185080ec1da08518e`	affected	< d2bbbb6c55812220fee5d801c275cc267ea3cbeb
`5005bcb4219156f1bf7587b185080ec1da08518e`	affected	< 8f0302fb691537d33ec8f668565257ea9d340ffe
`5005bcb4219156f1bf7587b185080ec1da08518e`	affected	< 7cad3ceaf679c55bc9946685dacafce78ce6b51a
`5005bcb4219156f1bf7587b185080ec1da08518e`	affected	< 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7
`5005bcb4219156f1bf7587b185080ec1da08518e`	affected	< 5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4
`5005bcb4219156f1bf7587b185080ec1da08518e`	affected	< 609ca17d869d04ba249e32cdcbf13c0b1c66f43c
`d1066c1b3663401cd23c0d6e60cdae750ce00c0f`	affected	—
`5.15.121`	affected	< 5.15.211
`6.1.36`	affected	< 6.1.177
`6.3.10`	affected	< 6.4

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.37`	unaffected	≤ 6.18.*
`7.0.14`	unaffected	≤ 7.0.*
`7.1.2`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[eb947403518ea3d93f6d89264bb1f5416bb0c7d0,25ff12b82a376ff5c4583102a63d2456a6b9ebb9)`	affected	code_commit	—
`[854156d12caa9d36de1cf5f084591c7686cc8a9d,fc578523a72cb8b329d32070b95898e81613cc3f)`	affected	code_commit	—
`[5005bcb4219156f1bf7587b185080ec1da08518e,d2bbbb6c55812220fee5d801c275cc267ea3cbeb)`	affected	code_commit	—
`[5005bcb4219156f1bf7587b185080ec1da08518e,8f0302fb691537d33ec8f668565257ea9d340ffe)`	affected	code_commit	—
`[5005bcb4219156f1bf7587b185080ec1da08518e,7cad3ceaf679c55bc9946685dacafce78ce6b51a)`	affected	code_commit	—
`[5005bcb4219156f1bf7587b185080ec1da08518e,06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7)`	affected	code_commit	—
`[5005bcb4219156f1bf7587b185080ec1da08518e,5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4)`	affected	code_commit	—
`[5005bcb4219156f1bf7587b185080ec1da08518e,609ca17d869d04ba249e32cdcbf13c0b1c66f43c)`	affected	code_commit	—
`d1066c1b3663401cd23c0d6e60cdae750ce00c0f`	affected	code_commit	—
`[5.15.121,5.15.211)`	affected	semver	—
`[6.1.36,6.1.177)`	affected	semver	—
`[6.3.10,6.4)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.4`	affected	semver	—
`[0,6.4)`	unaffected	generic	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.37,6.19.0)`	unaffected	semver	—
`[7.0.14,7.1.0)`	unaffected	semver	—
`[7.1.2,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the ksmbd session‑validation fix immediately.
If an immediate kernel upgrade is not possible, stop or mask the ksmbd service to prevent interaction with SMB clients until the kernel can be updated.
To reduce exposure, consider disabling SMBv2 or SMB3 on untrusted networks or using firewall rules to block inbound SMB traffic until the patch is deployed.

Generated by OpenCVE AI on July 30, 2026 at 22:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0069.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7
https://git.kernel.org/stable/c/25ff12b82a376ff5c4583102a63d2456a6b9ebb9
https://git.kernel.org/stable/c/5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4
https://git.kernel.org/stable/c/609ca17d869d04ba249e32cdcbf13c0b1c66f43c
https://git.kernel.org/stable/c/7cad3ceaf679c55bc9946685dacafce78ce6b51a
https://git.kernel.org/stable/c/8f0302fb691537d33ec8f668565257ea9d340ffe
https://git.kernel.org/stable/c/d2bbbb6c55812220fee5d801c275cc267ea3cbeb
https://git.kernel.org/stable/c/fc578523a72cb8b329d32070b95898e81613cc3f
https://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-53383-f003@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53383
https://www.cve.org/CVERecord?id=CVE-2026-53383

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-53383-f003@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53383 https://www.cve.org/CVERecord?id=CVE-2026-53383

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.
Title		ksmbd: reject non-VALID session in compound request branch
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7 https://git.kernel.org/stable/c/25ff12b82a376ff5c4583102a63d2456a6b9ebb9 https://git.kernel.org/stable/c/5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4 https://git.kernel.org/stable/c/609ca17d869d04ba249e32cdcbf13c0b1c66f43c https://git.kernel.org/stable/c/7cad3ceaf679c55bc9946685dacafce78ce6b51a https://git.kernel.org/stable/c/8f0302fb691537d33ec8f668565257ea9d340ffe https://git.kernel.org/stable/c/d2bbbb6c55812220fee5d801c275cc267ea3cbeb https://git.kernel.org/stable/c/fc578523a72cb8b329d32070b95898e81613cc3f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T11:59:31.616Z

Updated: 2026-08-05T12:35:22.899Z

Reserved: 2026-06-09T07:44:35.401Z

Link: CVE-2026-53383

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-53383 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:45:03Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object