FKIE_CVE-2026-53383

Vulnerability from fkie_nvd - Published: 2026-07-19 12:16 - Updated: 2026-08-17 05:17
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/25ff12b82a376ff5c4583102a63d2456a6b9ebb9Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/609ca17d869d04ba249e32cdcbf13c0b1c66f43cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7cad3ceaf679c55bc9946685dacafce78ce6b51aPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8f0302fb691537d33ec8f668565257ea9d340ffePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d2bbbb6c55812220fee5d801c275cc267ea3cbebPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fc578523a72cb8b329d32070b95898e81613cc3fPatch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel 6.4
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25ff12b82a376ff5c4583102a63d2456a6b9ebb9",
              "status": "affected",
              "version": "eb947403518ea3d93f6d89264bb1f5416bb0c7d0",
              "versionType": "git"
            },
            {
              "lessThan": "fc578523a72cb8b329d32070b95898e81613cc3f",
              "status": "affected",
              "version": "854156d12caa9d36de1cf5f084591c7686cc8a9d",
              "versionType": "git"
            },
            {
              "lessThan": "d2bbbb6c55812220fee5d801c275cc267ea3cbeb",
              "status": "affected",
              "version": "5005bcb4219156f1bf7587b185080ec1da08518e",
              "versionType": "git"
            },
            {
              "lessThan": "8f0302fb691537d33ec8f668565257ea9d340ffe",
              "status": "affected",
              "version": "5005bcb4219156f1bf7587b185080ec1da08518e",
              "versionType": "git"
            },
            {
              "lessThan": "7cad3ceaf679c55bc9946685dacafce78ce6b51a",
              "status": "affected",
              "version": "5005bcb4219156f1bf7587b185080ec1da08518e",
              "versionType": "git"
            },
            {
              "lessThan": "06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7",
              "status": "affected",
              "version": "5005bcb4219156f1bf7587b185080ec1da08518e",
              "versionType": "git"
            },
            {
              "lessThan": "5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4",
              "status": "affected",
              "version": "5005bcb4219156f1bf7587b185080ec1da08518e",
              "versionType": "git"
            },
            {
              "lessThan": "609ca17d869d04ba249e32cdcbf13c0b1c66f43c",
              "status": "affected",
              "version": "5005bcb4219156f1bf7587b185080ec1da08518e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d1066c1b3663401cd23c0d6e60cdae750ce00c0f",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.211",
              "status": "affected",
              "version": "5.15.121",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.177",
              "status": "affected",
              "version": "6.1.36",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B528AA1-AFF4-4B02-BA7F-CE91EBCAA24F",
              "versionEndExcluding": "5.15.211",
              "versionStartIncluding": "5.15.121",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C995237F-E217-4A59-BCDF-BC4091A4FA1A",
              "versionEndExcluding": "6.1.177",
              "versionStartIncluding": "6.1.36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E002324-2B5E-4373-A29E-1D5D0FC97F6F",
              "versionEndExcluding": "6.4",
              "versionStartIncluding": "6.3.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FB20250-D599-4124-9B31-4ACBD815386B",
              "versionEndExcluding": "6.6.144",
              "versionStartIncluding": "6.4.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8",
              "versionEndExcluding": "6.12.95",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E08ACB05-518A-4D61-A6C4-268D1BB6BF46",
              "versionEndExcluding": "6.18.37",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6241DF06-E6F3-4B61-B5A2-A60F2AE5B982",
              "versionEndExcluding": "7.0.14",
              "versionStartIncluding": "6.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C18FAA06-B61A-4036-A12D-F06F5135E64B",
              "versionEndExcluding": "7.1.2",
              "versionStartIncluding": "7.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reject non-VALID session in compound request branch\n\nsmb2_check_user_session() takes a shortcut for any operation that is not\nthe first in a COMPOUND request: it reuses work-\u003esess (the session bound by\nthe first operation) and validates only the SessionId, then returns\n\"valid\". It never re-checks work-\u003esess-\u003estate == SMB2_SESSION_VALID, and a\nSessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation\nvalue) skips even the id comparison. The standalone path\n(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does\nenforce the VALID state; the compound branch bypasses all of it.\n\nA SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes\na fresh SMB2_SESSION_IN_PROGRESS session whose sess-\u003euser is still NULL\n(-\u003euser is assigned later, by ntlm_authenticate()). Used as operation 1 of\na COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,\n\\\\host\\IPC$), the tree-connect then runs on that IN_PROGRESS session and\nreaches ksmbd_ipc_tree_connect_request(), which dereferences\nuser_name(sess-\u003euser) with sess-\u003euser == NULL (transport_ipc.c:687/701/704)\n-\u003e remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd\nworker for all clients.\n\nReject any non-first compound operation that lands on a session which is\nnot SMB2_SESSION_VALID, mirroring the validity the standalone lookup path\nenforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session,\nbut it is never carried as a non-first compound operation, so multi-leg\nauthentication is unaffected by this check."
    }
  ],
  "id": "CVE-2026-53383",
  "lastModified": "2026-08-17T05:17:12.240",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-19T12:16:49.117",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/25ff12b82a376ff5c4583102a63d2456a6b9ebb9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/609ca17d869d04ba249e32cdcbf13c0b1c66f43c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/7cad3ceaf679c55bc9946685dacafce78ce6b51a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/8f0302fb691537d33ec8f668565257ea9d340ffe"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d2bbbb6c55812220fee5d801c275cc267ea3cbeb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/fc578523a72cb8b329d32070b95898e81613cc3f"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.