CVE-2026-53383: ksmbd: reject non-VALID session in compound request branch
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reject non-VALID session in compound request branch
smb2checkusersession() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2SESSIONVALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONGMAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbdsessionlookupall() plus the SESSIONSETUP state machine) does enforce the VALID state; the compound branch bypasses all of it.
A SESSIONSETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2SESSIONINPROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlmauthenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREECONNECT (related, SessionId=ULLONGMAX, \\host\IPC$), the tree-connect then runs on that INPROGRESS session and reaches ksmbdipctreeconnectrequest(), which dereferences username(sess->user) with sess->user == NULL (transportipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients.
Reject any non-first compound operation that lands on a session which is not SMB2SESSIONVALID, mirroring the validity the standalone lookup path enforces. SESSIONSETUP itself legitimately runs on an INPROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/patch the Linux kernel so that ksmbd rejects any non-first compound operation that lands on a session where SESSION_SETUP is still IN_PROGRESS (i.e., enforce validity such that the compound branch does not bypass the SMB2_SESSION_VALID check).
Linux kernel ksmbd ksmbd compound request handling (SESSION_SETUP / non-first operations) = Enforce SMB2_SESSION_VALID for non-first compound operations
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the ksmbd SMB server available to network clients are exposed. The attack path targets SMB2 compound requests and the IPC$ tree-connect path.
Does exploitation require authentication or user interaction?
No. The CVSS vector specifies network access, low attack complexity, no privileges, and no user interaction. The described request begins SESSION_SETUP with only an NTLM Type-1 blob, leaving the session in progress without an assigned user.
What is the practical impact of successful exploitation?
A crafted SMB2 compound request can cause a TREE_CONNECT operation to run under an SMB2_SESSION_IN_PROGRESS session with sess->user still NULL. The IPC$ connection handling dereferences that NULL value, resulting in a denial of service.
What request characteristics trigger the vulnerable path?
The first compound operation is SESSION_SETUP carrying an NTLM Type-1 negotiate blob, followed by a related TREE_CONNECT to \\host\IPC$ using SessionId 0xFFFFFFFFFFFFFFFF. That related-operation SessionId bypasses the compound branch's SessionId comparison.