CVE-2026-53383

A flaw was found in the Linux kernel's ksmbd component. A remote attacker can trigger a NULL pointer dereference by sending a specially crafted compound SMB2 request. This occurs because the session validation logic for non-first operations in a compound request does not properly check the session state, allowing a tree connect operation to proceed with an invalid session. Successful exploitation leads to a kernel crash, causing a denial of service for all ksmbd clients.