Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-53383

ksmbd: reject non-VALID session in compound request branch

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • eb947403518ea3d93f6d89264bb1f5416bb0c7d0 to < 25ff12b82a376ff5c4583102a63d2456a6b9ebb9affected
  • 854156d12caa9d36de1cf5f084591c7686cc8a9d to < fc578523a72cb8b329d32070b95898e81613cc3faffected
  • 5005bcb4219156f1bf7587b185080ec1da08518e to < d2bbbb6c55812220fee5d801c275cc267ea3cbebaffected
  • 5005bcb4219156f1bf7587b185080ec1da08518e to < 8f0302fb691537d33ec8f668565257ea9d340ffeaffected
  • 5005bcb4219156f1bf7587b185080ec1da08518e to < 7cad3ceaf679c55bc9946685dacafce78ce6b51aaffected
  • 5005bcb4219156f1bf7587b185080ec1da08518e to < 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7affected
  • 5005bcb4219156f1bf7587b185080ec1da08518e to < 5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4affected
  • 5005bcb4219156f1bf7587b185080ec1da08518e to < 609ca17d869d04ba249e32cdcbf13c0b1c66f43caffected
  • d1066c1b3663401cd23c0d6e60cdae750ce00c0faffected
  • 5.15.121 to < 5.15.211affected
  • 6.1.36 to < 6.1.177affected
  • 6.3.10 to < 6.4affected

Linux Linux

Default version status: affected

  • 6.4affected
  • 0 to < 6.4unaffected
  • 5.15.211 to ≤ 5.15.*unaffected
  • 6.1.177 to ≤ 6.1.*unaffected
  • 6.6.144 to ≤ 6.6.*unaffected
  • 6.12.95 to ≤ 6.12.*unaffected
  • 6.18.37 to ≤ 6.18.*unaffected
  • 7.0.14 to ≤ 7.0.*unaffected
  • 7.1.2 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References