CVE-2026-53383
ksmbd: reject non-VALID session in compound request branch
Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.
INFO
Published Date :
July 19, 2026, 12:16 p.m.
Last Modified :
July 19, 2026, 12:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-53383
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Apply the Linux kernel patch for ksmbd.
- Update the Linux kernel to the latest version.
- Ensure ksmbd enforces session validity checks.
- Reject non-first compound operations on invalid sessions.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53383.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53383 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53383
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53383 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53383 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'eb947403518ea3d93f6d89264bb1f5416bb0c7d0', 'lessThan': '25ff12b82a376ff5c4583102a63d2456a6b9ebb9', 'versionType': 'git'}, {'status': 'affected', 'version': '854156d12caa9d36de1cf5f084591c7686cc8a9d', 'lessThan': 'fc578523a72cb8b329d32070b95898e81613cc3f', 'versionType': 'git'}, {'status': 'affected', 'version': '5005bcb4219156f1bf7587b185080ec1da08518e', 'lessThan': 'd2bbbb6c55812220fee5d801c275cc267ea3cbeb', 'versionType': 'git'}, {'status': 'affected', 'version': '5005bcb4219156f1bf7587b185080ec1da08518e', 'lessThan': '8f0302fb691537d33ec8f668565257ea9d340ffe', 'versionType': 'git'}, {'status': 'affected', 'version': '5005bcb4219156f1bf7587b185080ec1da08518e', 'lessThan': '7cad3ceaf679c55bc9946685dacafce78ce6b51a', 'versionType': 'git'}, {'status': 'affected', 'version': '5005bcb4219156f1bf7587b185080ec1da08518e', 'lessThan': '06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7', 'versionType': 'git'}, {'status': 'affected', 'version': '5005bcb4219156f1bf7587b185080ec1da08518e', 'lessThan': '5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4', 'versionType': 'git'}, {'status': 'affected', 'version': '5005bcb4219156f1bf7587b185080ec1da08518e', 'lessThan': '609ca17d869d04ba249e32cdcbf13c0b1c66f43c', 'versionType': 'git'}, {'status': 'affected', 'version': 'd1066c1b3663401cd23c0d6e60cdae750ce00c0f', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.121', 'lessThan': '5.15.211', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.36', 'lessThan': '6.1.177', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.3.10', 'lessThan': '6.4', 'versionType': 'semver'}], 'programFiles': ['fs/smb/server/smb2pdu.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.37', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.14', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1.2', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/smb/server/smb2pdu.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check. Added Reference https://git.kernel.org/stable/c/06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7 Added Reference https://git.kernel.org/stable/c/25ff12b82a376ff5c4583102a63d2456a6b9ebb9 Added Reference https://git.kernel.org/stable/c/5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4 Added Reference https://git.kernel.org/stable/c/609ca17d869d04ba249e32cdcbf13c0b1c66f43c Added Reference https://git.kernel.org/stable/c/7cad3ceaf679c55bc9946685dacafce78ce6b51a Added Reference https://git.kernel.org/stable/c/8f0302fb691537d33ec8f668565257ea9d340ffe Added Reference https://git.kernel.org/stable/c/d2bbbb6c55812220fee5d801c275cc267ea3cbeb Added Reference https://git.kernel.org/stable/c/fc578523a72cb8b329d32070b95898e81613cc3f