Answer in brief
CVE-2026-53383 records a High severity (CVSS 7.5) vulnerability in ksmbd: reject non-VALID session in compound request branch. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=eb947403518ea3d93f6d89264bb1f5416bb0c7d0 <25ff12b82a376ff5c4583102a63d2456a6b9ebb9 || >=854156d12caa9d36de1cf5f084591c7686cc8a9d <fc578523a72cb8b329d32070b95898e81613cc3f || >=5005bcb4219156f1bf7587b185080ec1da08518e <d2bbbb6c55812220fee5d801c275cc267ea3cbeb || >=5005bcb4219156f1bf7587b185080ec1da08518e <8f0302fb691537d33ec8f668565257ea9d340ffe || >=5005bcb4219156f1bf7587b185080ec1da08518e <7cad3ceaf679c55bc9946685dacafce78ce6b51a || >=5005bcb4219156f1bf7587b185080ec1da08518e <06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7 || >=5005bcb4219156f1bf7587b185080ec1da08518e <5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4 || >=5005bcb4219156f1bf7587b185080ec1da08518e <609ca17d869d04ba249e32cdcbf13c0b1c66f43c || d1066c1b3663401cd23c0d6e60cdae750ce00c0f || >=5.15.121 <5.15.211 || >=6.1.36 <6.1.177 || >=6.3.10 <6.4 | 25ff12b82a376ff5c4583102a63d2456a6b9ebb9, fc578523a72cb8b329d32070b95898e81613cc3f, d2bbbb6c55812220fee5d801c275cc267ea3cbeb, 8f0302fb691537d33ec8f668565257ea9d340ffe, 7cad3ceaf679c55bc9946685dacafce78ce6b51a, 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7, 5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4, 609ca17d869d04ba249e32cdcbf13c0b1c66f43c, 5.15.211, 6.1.177, 6.4 |
| Linux/Linuxgeneric | 6.4 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.
Quoted source text, attributed separately from HOL analysis.