CVE-2026-53383: Linux Kernel ksmbd RCE Vulnerability

CVE-2026-53383 Overview

CVE-2026-53383 is a NULL pointer dereference vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw lives in smb2_check_user_session(), which shortcuts session validation for non-first operations inside a COMPOUND request. The function reuses work->sess and skips the SMB2_SESSION_VALID state check that the standalone lookup path enforces. A remote unauthenticated attacker can chain a SESSION_SETUP (NTLM Type-1) with a related TREE_CONNECT to reach ksmbd_ipc_tree_connect_request() while sess->user is still NULL, triggering a kernel Oops that wedges the ksmbd worker for all clients.

Critical Impact
Remote unauthenticated attackers can crash the ksmbd worker thread, causing denial of service for every SMB client served by the target host.

Affected Products

Linux kernel builds shipping the ksmbd in-kernel SMB server
Distributions exposing ksmbd to untrusted networks
Systems using ksmbd for IPC$ share access

Discovery Timeline

2026-07-19 - CVE-2026-53383 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-53383

Vulnerability Analysis

The vulnerability stems from inconsistent session state validation between two code paths in ksmbd. The standalone path calls ksmbd_session_lookup_all() and drives the SESSION_SETUP state machine, which enforces that sess->state == SMB2_SESSION_VALID before allowing operations. The COMPOUND request branch takes a shortcut: it reuses work->sess from the first operation and validates only the SessionId field.

When a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation marker) is supplied, even the ID comparison is skipped. The compound branch returns "valid" without confirming the session ever completed authentication.

Root Cause

A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh session in the SMB2_SESSION_IN_PROGRESS state. Its sess->user pointer remains NULL because assignment happens later inside ntlm_authenticate(). The compound branch has no guard against operating on an in-progress session, so subsequent related operations execute against a half-initialized structure.

Attack Vector

An attacker sends a single COMPOUND SMB2 request over the network. Operation one is a SESSION_SETUP containing only the NTLM negotiate blob. Operation two is a related TREE_CONNECT to \\host\IPC$ with SessionId set to ULLONG_MAX. The tree-connect runs on the in-progress session and reaches ksmbd_ipc_tree_connect_request() in transport_ipc.c (lines 687, 701, 704). The call to user_name(sess->user) dereferences the NULLsess->user pointer, producing a kernel Oops. No authentication is required.

The vulnerability requires no privileges, no user interaction, and is exploitable across the network. Only availability is affected, matching the CVSS availability-only impact profile.

Detection Methods for CVE-2026-53383

Indicators of Compromise

Kernel Oops or BUG entries in dmesg referencing ksmbd_ipc_tree_connect_request, user_name, or transport_ipc.c with a NULL pointer dereference
ksmbd worker threads becoming unresponsive after inbound SMB traffic from an untrusted source
SMB clients reporting sudden STATUS_CONNECTION_DISCONNECTED errors across multiple sessions simultaneously

Detection Strategies

Inspect SMB2 traffic for COMPOUND requests where a SESSION_SETUP (NTLM Type-1 only) is immediately followed by a related TREE_CONNECT targeting IPC$
Alert on inbound SMB2 requests carrying SessionId=0xFFFFFFFFFFFFFFFF addressed to sessions that have not completed authentication
Correlate kernel crash telemetry with recent SMB session-setup activity from the same source IP

Monitoring Recommendations

Forward dmesg and journald kernel logs from ksmbd hosts into a centralized log platform for crash pattern analysis
Track ksmbd worker liveness with a periodic health probe that opens and closes an authenticated SMB session
Monitor network egress and ingress on TCP/445 for anomalous session-setup rates from single sources

How to Mitigate CVE-2026-53383

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the stable tree commits listed in the kernel.org stable commits
Restrict TCP/445 exposure to trusted management networks using host firewall rules or network segmentation
Disable ksmbd on hosts that do not require an in-kernel SMB server and use a userspace alternative where feasible

Patch Information

The fix rejects any non-first compound operation that lands on a session which is not in the SMB2_SESSION_VALID state, mirroring the enforcement performed by the standalone lookup path. SESSION_SETUP is still permitted on IN_PROGRESS sessions because it is never legitimately carried as a non-first compound operation, so multi-leg NTLM authentication continues to work. Backports are available across multiple stable branches; see the ksmbd fix commit and the additional stable backport.

Workarounds

Stop and disable the ksmbd.service unit until patched kernels are deployed
Block inbound TCP/445 at the perimeter and internal firewalls for hosts running vulnerable ksmbd builds
Require SMB clients to connect through a Samba (userspace) gateway that is not affected by this ksmbd flaw

bash

# Disable ksmbd and block SMB ingress until the patched kernel is installed
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd
sudo iptables -A INPUT -p tcp --dport 445 -j DROP