In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reject non-VALID session in compound request branch
smb2checkusersession() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2SESSIONVALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONGMAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbdsessionlookupall() plus the SESSIONSETUP state machine) does enforce the VALID state; the compound branch bypasses all of it.
A SESSIONSETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2SESSIONINPROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlmauthenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREECONNECT (related, SessionId=ULLONGMAX, \host\IPC$), the tree-connect then runs on that INPROGRESS session and reaches ksmbdipctreeconnectrequest(), which dereferences username(sess->user) with sess->user == NULL (transportipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients.
Reject any non-first compound operation that lands on a session which is not SMB2SESSIONVALID, mirroring the validity the standalone lookup path enforces. SESSIONSETUP itself legitimately runs on an INPROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53383.json",
"cna_assigner": "Linux"
}