7.5

CVE-2026-53383: ksmbd: reject non-VALID session in compound request branch

Analyzed
AliasesUBUNTU-CVE-2026-53383DEBIAN-CVE-2026-53383
Published 19-07-2026Last modified 17-08-2026

Vulnerability summary

CVE-2026-53383 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 51.7% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.66%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 20
MGASA-2026-0312OPENSUSE-SU-2026:11339-1USN-8726-1USN-8726-2USN-8726-3USN-8726-4

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 17-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.66%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.66% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu157 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-147.147 | < 7.0.0-31.31
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1067.70 | < 7.0.0-1012.12
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ eb947403518ea3d93f6d89264bb1f5416bb0c7d0, < 25ff12b82a376ff5c4583102a63d2456a6b9ebb9 | ≥ 854156d12caa9d36de1cf5f084591c7686cc8a9d, < fc578523a72cb8b329d32070b95898e81613cc3f | ≥ 5005bcb4219156f1bf7587b185080ec1da08518e, < d2bbbb6c55812220fee5d801c275cc267ea3cbeb | ≥ 5005bcb4219156f1bf7587b185080ec1da08518e, < 8f0302fb691537d33ec8f668565257ea9d340ffe | ≥ 5005bcb4219156f1bf7587b185080ec1da08518e, < 7cad3ceaf679c55bc9946685dacafce78ce6b51a | ≥ 5005bcb4219156f1bf7587b185080ec1da08518e, < 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7 | ≥ 5005bcb4219156f1bf7587b185080ec1da08518e, < 5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4 | ≥ 5005bcb4219156f1bf7587b185080ec1da08518e, < 609ca17d869d04ba249e32cdcbf13c0b1c66f43c | d1066c1b3663401cd23c0d6e60cdae750ce00c0f | ≥ 5.15.121, < 5.15.211 | ≥ 6.1.36, < 6.1.177 | ≥ 6.3.10, < 6.4 | 6.4
  • linux_kernelEOL≥ 5.15.121, < 5.15.211 | ≥ 6.1.36, < 6.1.177 | ≥ 6.3.10, < 6.4 | ≥ 6.4.1, < 6.6.144 | ≥ 6.7, < 6.12.95 | ≥ 6.13, < 6.18.37 | ≥ 6.19, < 7.0.14 | ≥ 7.1, < 7.1.2 | 6.4
Debian1 product
  • linux< 6.1.177-1 | < 6.12.95-1 | < 7.0.14-1

3 vendors · 160 products

References

31 links
Show all 31 references