CVE-2026-53383

What it actually does

CVE-2026-53383 is a remotely triggerable denial-of-service flaw in the Linux kernel ksmbd SMB server. In SMB2 compound request handling, ksmbd incorrectly treats later operations in a compound request as valid if they reuse the session from the first operation, without confirming that the session has reached SMB2_SESSION_VALID state. A specially crafted compound request can start an NTLM authentication flow with a SESSION_SETUP containing only an NTLM Type-1 negotiate message, leaving the session in SMB2_SESSION_IN_PROGRESS with no authenticated user object, then immediately issue a related TREE_CONNECT to IPC$ using the special related-operation SessionId value 0xFFFFFFFFFFFFFFFF. The TREE_CONNECT path can dereference sess->user while it is NULL, causing a kernel NULL-pointer dereference/Oops and wedging the ksmbd worker, disrupting SMB service availability.

Why it matters to the business

An unauthenticated network attacker who can reach a vulnerable ksmbd SMB service can crash or stall SMB file-sharing service for legitimate users. This can interrupt access to shared files, application dependencies, administrative shares, backup workflows, and other business processes relying on SMB. The CVSS score indicates high availability impact, but the current EPSS score is low and the issue is not listed in CISA KEV, so broad active exploitation is not currently indicated by the provided data. Because exploitation requires only network access to the SMB service and no credentials, internet-exposed or broadly reachable ksmbd deployments should still be prioritized for remediation.

How an attack unfolds

An attacker first identifies a host running the Linux kernel ksmbd SMB server with TCP/445 reachable. The attacker opens an SMB2 connection and sends a compound request where the first operation is SESSION_SETUP containing only an NTLM Type-1 negotiate blob. This causes ksmbd to create and publish a session that is still in the authentication-in-progress state and has no associated user object. In the same compound request, the attacker sends a related TREE_CONNECT operation targeting the IPC$ share and uses the SMB2 related-operation SessionId value 0xFFFFFFFFFFFFFFFF. Because the vulnerable compound-request branch reuses the first operation’s session without verifying that it is fully valid, TREE_CONNECT proceeds on the incomplete session. ksmbd then reaches the IPC tree-connect handling path and dereferences the missing user pointer, causing a kernel Oops/NULL-pointer dereference and disrupting the ksmbd worker for clients.

How to fix it

Apply a Linux kernel update from the operating system or appliance vendor that includes the ksmbd fix rejecting non-first compound operations unless the reused session is in SMB2_SESSION_VALID state. No exact fixed package versions were provided, so use vendor advisories, distribution kernel changelogs, or upstream stable kernel release notes to identify the corrected build for each platform. If immediate patching is not possible, mitigate by disabling ksmbd where not required, replacing it with a supported patched SMB service where appropriate, restricting TCP/445 exposure to trusted networks and VPNs, and blocking unauthenticated or internet-origin SMB access at firewalls. Avoid relying on authentication as a compensating control because the described trigger occurs before successful authentication.

How to confirm the fix worked

Confirm the running kernel package includes the ksmbd patch for rejecting non-VALID sessions in SMB2 compound request handling. Validate that ksmbd is either not running or is running on a patched kernel. Check exposure by verifying whether TCP/445 is reachable from untrusted networks and whether ksmbd is enabled through kernel modules or service configuration. For patched systems, a crafted compound request matching the vulnerable sequence should be rejected rather than causing a kernel Oops or ksmbd worker failure. Review kernel logs after validation to ensure no NULL-pointer dereference, Oops, or stack trace referencing ksmbd_ipc_tree_connect_request occurred.

Typical attack path

1. Discover SMB service exposure on TCP/445 and confirm the target is using Linux ksmbd rather than only a user-space SMB implementation.
2. Establish an SMB2 session with the target service.
3. Send a crafted SMB2 compound request whose first operation is SESSION_SETUP with an NTLM Type-1 negotiate message only.
4. Include a related second operation in the same compound request: TREE_CONNECT to \\target\IPC$ with SessionId set to 0xFFFFFFFFFFFFFFFF.
5. Trigger ksmbd to process TREE_CONNECT on an SMB2_SESSION_IN_PROGRESS session with sess->user unset.
6. Cause a kernel NULL-pointer dereference/Oops in the ksmbd IPC tree-connect path, resulting in SMB service disruption.

How to detect it

To determine whether exploitation has already occurred, review kernel logs, system journal logs, crash dumps, and monitoring alerts for ksmbd worker crashes, kernel Oops events, NULL-pointer dereferences, or stack traces in the IPC tree-connect path. Useful sources include dmesg output, /var/log/kern.log, /var/log/messages, journalctl -k, crash dump directories, EDR kernel event telemetry, service availability monitors, and network telemetry for SMB traffic. Look for an SMB2 compound request pattern involving SESSION_SETUP followed immediately by a related TREE_CONNECT to IPC$ using SessionId 0xFFFFFFFFFFFFFFFF, especially when followed by ksmbd instability or client disconnects. Because the flaw causes denial of service rather than code execution, durable host artifacts may be limited to kernel crash logs, service restart events, connection logs, and network captures. No named threat actors or active exploitation campaigns were provided for this CVE.

• ksmbd_ipc_tree_connect_request
• transport_ipc.c:687
• transport_ipc.c:701
• transport_ipc.c:704
• NULL pointer dereference
• kernel NULL pointer dereference
• Oops: 0000
• BUG: kernel NULL pointer dereference
• ksmbd: reject non-VALID session
• SMB2_SESSION_IN_PROGRESS
• SMB2_SESSION_VALID
• SessionId=0xffffffffffffffff
• SessionId 0xFFFFFFFFFFFFFFFF
• TREE_CONNECT \\*\IPC$
• IPC$
• SESSION_SETUP
• NtLmNegotiate
• NTLM Type-1
• ksmbd

What your security team should do

• Inventory systems exposing SMB on TCP/445 and identify which use Linux kernel ksmbd.
• Prioritize patching internet-facing, DMZ, appliance, NAS, file-sharing, backup, and broadly reachable internal ksmbd deployments.
• Apply vendor kernel updates that include the ksmbd compound-session validation fix; if fixed versions are unavailable, track vendor advisories until corrected packages are published.
• Temporarily disable ksmbd or restrict TCP/445 to trusted administrative and client networks where patching cannot be completed quickly.
• Add monitoring for kernel Oops messages and ksmbd stack traces involving SMB2 SESSION_SETUP, TREE_CONNECT, IPC$, or ksmbd_ipc_tree_connect_request.
• Hunt historical kernel and system logs for evidence of prior crashes or service disruption matching this failure pattern.
• Ensure SMB is not exposed directly to the internet unless explicitly required and protected by strong network access controls.