In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch… (CVE-2026-53383)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's ksmbd SMB server arises from improper session validation in compound SMB2 requests. The function smb2_check_user_session() reuses the session from the first operation without re-checking if the session state is SMB2_SESSION_VALID. A special SessionId value (ULLONG_MAX) bypasses even the ID comparison. This allows a compound request where the first operation is a SESSION_SETUP with an in-progress session (user pointer NULL) followed by a TREE_CONNECT operation that dereferences the NULL user pointer, causing a kernel NULL-pointer dereference and Oops. The fix enforces rejection of non-first compound operations on sessions that are not in the valid state, aligning with the standalone session lookup path's checks. Multi-leg authentication flows remain unaffected as SESSION_SETUP is never a non-first compound operation.
Potential Impact
Exploitation of this vulnerability results in a NULL-pointer dereference in the kernel, causing a kernel Oops and effectively a denial of service by wedging the ksmbd worker thread. This impacts all clients relying on the ksmbd SMB server until the service or system is restarted. There is no indication of privilege escalation or data corruption from the provided information.
Mitigation Recommendations
A fix is available that rejects any non-first compound SMB2 operation on sessions that are not fully validated (SMB2_SESSION_VALID). Users should apply the official Linux kernel patches that address this issue once available. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not yet confirmed in the provided data; users should monitor vendor advisories for the official fix.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch… (CVE-2026-53383)
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's ksmbd SMB server arises from improper session validation in compound SMB2 requests. The function smb2_check_user_session() reuses the session from the first operation without re-checking if the session state is SMB2_SESSION_VALID. A special SessionId value (ULLONG_MAX) bypasses even the ID comparison. This allows a compound request where the first operation is a SESSION_SETUP with an in-progress session (user pointer NULL) followed by a TREE_CONNECT operation that dereferences the NULL user pointer, causing a kernel NULL-pointer dereference and Oops. The fix enforces rejection of non-first compound operations on sessions that are not in the valid state, aligning with the standalone session lookup path's checks. Multi-leg authentication flows remain unaffected as SESSION_SETUP is never a non-first compound operation.
Potential Impact
Exploitation of this vulnerability results in a NULL-pointer dereference in the kernel, causing a kernel Oops and effectively a denial of service by wedging the ksmbd worker thread. This impacts all clients relying on the ksmbd SMB server until the service or system is restarted. There is no indication of privilege escalation or data corruption from the provided information.
Mitigation Recommendations
A fix is available that rejects any non-first compound SMB2 operation on sessions that are not fully validated (SMB2_SESSION_VALID). Users should apply the official Linux kernel patches that address this issue once available. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not yet confirmed in the provided data; users should monitor vendor advisories for the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-pgwm-2698-9pp5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53383"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27ad2a4a8d598913225e
Added to database: 07/19/2026, 19:38:21 UTC
Last enriched: 07/19/2026, 20:23:19 UTC
Last updated: 07/20/2026, 19:41:22 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.