CVE-2026-53383

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: reject non-VALID session in compound request branch

smb2_check_user_session() takes a shortcut for any operation that is not

the first in a COMPOUND request: it reuses work->sess (the session bound by

the first operation) and validates only the SessionId, then returns

"valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a

SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation

value) skips even the id comparison. The standalone path

(ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does

enforce the VALID state; the compound branch bypasses all of it.

A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes

a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL

(->user is assigned later, by ntlm_authenticate()). Used as operation 1 of

a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX,

\\host\IPC$)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References