PT-2026-61088 · Linux · Linux
CVE-2026-53383
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reject non-VALID session in compound request branch
smb2 check user session() takes a shortcut for any operation that is not
the first in a COMPOUND request: it reuses work->sess (the session bound by
the first operation) and validates only the SessionId, then returns
"valid". It never re-checks work->sess->state == SMB2 SESSION VALID, and a
SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG MAX, the MS-SMB2 related-operation
value) skips even the id comparison. The standalone path
(ksmbd session lookup all() plus the SESSION SETUP state machine) does
enforce the VALID state; the compound branch bypasses all of it.
A SESSION SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes
a fresh SMB2 SESSION IN PROGRESS session whose sess->user is still NULL
(->user is assigned later, by ntlm authenticate()). Used as operation 1 of
a COMPOUND with operation 2 = TREE CONNECT (related, SessionId=ULLONG MAX,
hostIPC$), the tree-connect then runs on that IN PROGRESS session and
reaches ksmbd ipc tree connect request(), which dereferences
user name(sess->user) with sess->user == NULL (transport ipc.c:687/701/704)
-> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd
worker for all clients.
Reject any non-first compound operation that lands on a session which is
not SMB2 SESSION VALID, mirroring the validity the standalone lookup path
enforces. SESSION SETUP itself legitimately runs on an IN PROGRESS session,
but it is never carried as a non-first compound operation, so multi-leg
authentication is unaffected by this check.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux