CVE-2026-53383

Awaiting Analysis Awaiting Analysis - Queue

NULL Pointer Dereference in ksmbd Linux Kernel SMB Server

Publication date: 2026-07-19

Last updated on: 2026-07-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-29

Generated

2026-08-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-08

NVD

CVE-2026-53383

EUVD

EUVD-2026-45505

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.4
linux	linux_kernel	From 6.3.10 (inc) to 6.4 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.37 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.14 (exc)
linux	linux_kernel	From 7.1 (inc) to 7.1.2 (exc)
linux	linux_kernel	From 5.15.121 (inc) to 5.15.211 (exc)
linux	linux_kernel	From 6.1.36 (inc) to 6.1.177 (exc)
linux	linux_kernel	From 6.4.1 (inc) to 6.6.144 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's ksmbd component allows a remote attacker to cause a kernel crash (Oops) by sending a crafted SMB compound request. The issue occurs when a non-first operation in a compound request uses an invalid or in-progress session, leading to a NULL pointer dereference in the ksmbd_ipc_tree_connect_request function.

Detection Guidance

This vulnerability affects the ksmbd kernel module in Linux systems. Detection requires checking if the system is running a vulnerable kernel version. Use uname -a to check the kernel version. If the system uses ksmbd, monitor for kernel oops or crashes during SMB operations, particularly compound requests involving IPC$ shares.

Impact Analysis

This vulnerability can cause the ksmbd service to crash, leading to denial of service for all connected clients. It may also allow remote attackers to execute arbitrary code with kernel privileges if exploited successfully.

Compliance Impact

This vulnerability causes a kernel crash (Oops) in the ksmbd worker, leading to denial of service. It does not directly impact data confidentiality or integrity but may disrupt services handling sensitive data, potentially affecting compliance with GDPR or HIPAA due to service unavailability.

Mitigation Strategies

Disable the ksmbd kernel module if not required. Update the Linux kernel to a patched version. Restrict access to SMB shares, especially IPC$, and monitor for unusual SMB traffic patterns that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-53383. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70