CyberSecBulletin
CVE-2026-53383NVD status: Analyzed

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-53383 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 25ff12b82a376ff5c4583102a63d2456a6b9ebb9, fc578523a72cb8b329d32070b95898e81613cc3f, d2bbbb6c55812220fee5d801c275cc267ea3cbeb as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.66% chance of exploitation within 30 days, higher than 52% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 25ff12b82a376ff5c4583102a63d2456a6b9ebb9 or fc578523a72cb8b329d32070b95898e81613cc3f or d2bbbb6c55812220fee5d801c275cc267ea3cbeb or 8f0302fb691537d33ec8f668565257ea9d340ffe, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.211 or 6.1.177 or 6.4 or 6.6.144, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxeb947403518ea3d93f6d89264bb1f5416bb0c7d0 up to, but not including, 25ff12b82a376ff5c4583102a63d2456a6b9ebb9; 854156d12caa9d36de1cf5f084591c7686cc8a9d up to, but not including, fc578523a72cb8b329d32070b95898e81613cc3f; 5005bcb4219156f1bf7587b185080ec1da08518e up to, but not including, d2bbbb6c55812220fee5d801c275cc267ea3cbeb; 5005bcb4219156f1bf7587b185080ec1da08518e up to, but not including, 8f0302fb691537d33ec8f668565257ea9d340ffe; 5005bcb4219156f1bf7587b185080ec1da08518e up to, but not including, 7cad3ceaf679c55bc9946685dacafce78ce6b51a; 5005bcb4219156f1bf7587b185080ec1da08518e up to, but not including, 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7; 5005bcb4219156f1bf7587b185080ec1da08518e up to, but not including, 5f983b864d3d473ac533b2f4f44a1bbe5dcbccf4; 5005bcb4219156f1bf7587b185080ec1da08518e up to, but not including, 609ca17d869d04ba249e32cdcbf13c0b1c66f43c; and 5 more ranges25ff12b82a376ff5c4583102a63d2456a6b9ebb9, fc578523a72cb8b329d32070b95898e81613cc3f, d2bbbb6c55812220fee5d801c275cc267ea3cbeb, 8f0302fb691537d33ec8f668565257ea9d340ffe, 7cad3ceaf679c55bc9946685dacafce78ce6b51a, 06e1f05a1dbe8bbd054c0927b17fc0a61cc8bef7
LinuxLinux Kernel5.15.121 up to, but not including, 5.15.211; 6.1.36 up to, but not including, 6.1.177; 6.3.10 up to, but not including, 6.4; 6.4.1 up to, but not including, 6.6.144; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.37; 6.19 up to, but not including, 7.0.14; 7.1 up to, but not including, 7.1.2; and 1 more ranges5.15.211, 6.1.177, 6.4, 6.6.144, 6.12.95, 6.18.37

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_SESSION_VALID, and a SessionId of 0xFFFFFFFFFFFFFFFF (ULLONG_MAX, the MS-SMB2 related-operation value) skips even the id comparison. The standalone path (ksmbd_session_lookup_all() plus the SESSION_SETUP state machine) does enforce the VALID state; the compound branch bypasses all of it. A SESSION_SETUP carrying only an NTLM Type-1 (NtLmNegotiate) blob publishes a fresh SMB2_SESSION_IN_PROGRESS session whose sess->user is still NULL (->user is assigned later, by ntlm_authenticate()). Used as operation 1 of a COMPOUND with operation 2 = TREE_CONNECT (related, SessionId=ULLONG_MAX, \\host\IPC$), the tree-connect then runs on that IN_PROGRESS session and reaches ksmbd_ipc_tree_connect_request(), which dereferences user_name(sess->user) with sess->user == NULL (transport_ipc.c:687/701/704) -> remote NULL-pointer dereference and a kernel Oops that wedges the ksmbd worker for all clients. Reject any non-first compound operation that lands on a session which is not SMB2_SESSION_VALID, mirroring the validity the standalone lookup path enforces. SESSION_SETUP itself legitimately runs on an IN_PROGRESS session, but it is never carried as a non-first compound operation, so multi-leg authentication is unaffected by this check.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.