Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation valu
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:3e39b8eb6f3918e4e80a33a719ac83d03cec7c8a032915c7da5bd54f5e1804e9
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25ff12b82a376ff5c4583102a63d2456a6b9ebb9","status":"affected","version":"eb947403518ea3d93f6d89264bb1f5416bb0c7d0","versionType":"git"},{"lessThan":"fc578523a72cb8b329d32070b95898e81613cc3f","status":"affected","version":"854156d12caa9d36de1cf5f084591c7686cc8a9d","versionType":"git"},{"lessThan":"d2bbbb6c55812220fee5d801c275cc267ea3cbeb","status":"affected","version":"5005bcb4219156f1bf7587…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanO…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"25ff12b82a376ff5c4583102a63d2456a6b9ebb9","status":"affected","version":"eb947403518ea3d93f6d89264bb1f5416bb0c7d0","versionType":"git"},{"lessThan":"fc578523a72cb8b329d32070b95898e81613cc3f","status":"affected","version":"854156d12caa9d36de1cf5f084591c7686cc8a9d","versionType":"git"},{"lessThan":"d2bbbb6c55812220fee5d801c275cc267ea3cbeb","status":"affected","version":"5005bcb4219156f1bf7587…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanO…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/25ff12b82a376ff5c4583102a63d2456a6b9ebb9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/609ca17d869d04ba249e32cdcbf13c0b1c66f43c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/7cad3ceaf679c55bc9946685dacafce78ce6b51a"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/8f0302fb691537d33ec8f668565257ea9d340ffe"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/d2bbbb6c55812220fee5d801c275cc267ea3cbeb"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/fc578523a72cb8b329d32070b95898e81613cc3f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4470d2435661fa528cf7a379ca3a744594b3d8db00890dfe4f3d109f71e3972f · sha256:85bad8158fee51d1… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer