CVE-2026-53383

CVE CVE-2026-53383EUVD EUVD-2026-45505Published 2026-07-19T11:59:31.000ZLast changed 2026-08-05T12:35:22.000ZCVSS 7.5

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.6.144; 854156d12caa9d36de1cf5f084591c7686cc8a9d <fc578523a72cb8b329d32070b95898e81613cc3f; patch: 0; 6.1.36 <6.1.177; patch: 7.0.14; 5005bcb4219156f1bf7587b185080ec1da08518e <d2bbbb6c55812220fee5d801c275cc267ea3cbeb; eb947403518ea3d93f6d89264bb1f5416bb0c7d0 <25ff12b82a376ff5c4583102a63d2456a6b9ebb9; 5.15.121 <5.15.211; 5005bcb4219156f1bf7587b185080ec1da08518e <8f0302fb691537d33ec8f668565257ea9d340ffe; patch: 7.1.2; patch: 6.1.177; 5005bcb4219156f1bf7587b185080ec1da08518e <609ca17d869d04ba249e32cdcbf13c0b1c66f43c; 6.3.10 <6.4; 5005bcb4219156f1bf7587b185080ec1da08518e <7cad3ceaf679c55bc9946685dacafce78ce6b51a; patch: 6.18.37; patch: 7.2-rc1; patch: 6.12.95; 5005bcb4219156f1bf7587b185080ec1da08518e <06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7; d1066c1b3663401cd23c0d6e60cdae750ce00c0f; 5005bcb4219156f1bf7587b185080ec1da08518e <5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4; patch: 5.15.211; 6.4

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.