CVE-2026-53383
Received Received - Intake

NULL Pointer Dereference in ksmbd Linux Kernel SMB Server

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-53383
EUVD
EUVD-2026-45505

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's ksmbd component allows a remote attacker to cause a kernel crash (Oops) by sending a crafted SMB compound request. The issue occurs when a non-first operation in a compound request uses an invalid or in-progress session, leading to a NULL pointer dereference in the ksmbd_ipc_tree_connect_request function.

Detection Guidance

This vulnerability affects the ksmbd kernel module in Linux systems. Detection requires checking if the system is running a vulnerable kernel version. Use uname -a to check the kernel version. If the system uses ksmbd, monitor for kernel oops or crashes during SMB operations, particularly compound requests involving IPC$ shares.

Impact Analysis

This vulnerability can cause the ksmbd service to crash, leading to denial of service for all connected clients. It may also allow remote attackers to execute arbitrary code with kernel privileges if exploited successfully.

Compliance Impact

This vulnerability causes a kernel crash (Oops) in the ksmbd worker, leading to denial of service. It does not directly impact data confidentiality or integrity but may disrupt services handling sensitive data, potentially affecting compliance with GDPR or HIPAA due to service unavailability.

Mitigation Strategies

Disable the ksmbd kernel module if not required. Update the Linux kernel to a patched version. Restrict access to SMB shares, especially IPC$, and monitor for unusual SMB traffic patterns that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53383. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart