ksmbd: validate session id and tree id in the compound request

Summary

CVE	CVE-2023-3866
State	PUBLISHED
Assigner	Linux
Source Priority	CVE Program / NVD first with legacy fallback
Published	2025-08-16 14:15:27 UTC
Updated	2026-08-04 10:18:25 UTC
Description	In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in the compound request This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error.

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-476

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	416baaa9-dc9f-4396-8d5f-8c081fb06d67	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	CNA	DECLARED	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Linux	Linux Kernel	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Linux	Linux	affected 0626e6641f6b467447c81dd7678a69c66f7746cf eb947403518ea3d93f6d89264bb1f5416bb0c7d0 git	Not specified
CNA	Linux	Linux	affected 0626e6641f6b467447c81dd7678a69c66f7746cf 854156d12caa9d36de1cf5f084591c7686cc8a9d git	Not specified
CNA	Linux	Linux	affected 0626e6641f6b467447c81dd7678a69c66f7746cf d1066c1b3663401cd23c0d6e60cdae750ce00c0f git	Not specified
CNA	Linux	Linux	affected 0626e6641f6b467447c81dd7678a69c66f7746cf 5005bcb4219156f1bf7587b185080ec1da08518e git	Not specified
CNA	Linux	Linux	affected 5.15	Not specified
CNA	Linux	Linux	unaffected 5.15 semver	Not specified
CNA	Linux	Linux	unaffected 5.15.121 5.15.* semver	Not specified
CNA	Linux	Linux	unaffected 6.1.36 6.1.* semver	Not specified
CNA	Linux	Linux	unaffected 6.3.10 6.3.* semver	Not specified
CNA	Linux	Linux	unaffected 6.4 * original_commit_for_fix	Not specified

Reference	Source	Link	Tags
git.kernel.org/stable/c/eb947403518ea3d93f6d89264bb1f5416bb0c7d0	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
git.kernel.org/stable/c/d1066c1b3663401cd23c0d6e60cdae750ce00c0f	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
git.kernel.org/stable/c/5005bcb4219156f1bf7587b185080ec1da08518e	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
git.kernel.org/stable/c/854156d12caa9d36de1cf5f084591c7686cc8a9d	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

199809 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6416-1)
199814 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6416-2)
199840 Ubuntu Security Notification for Linux kernel (Raspberry Pi) Vulnerabilities (USN-6416-3)
199844 Ubuntu Security Notification for Linux kernel (Intel IoTG) Vulnerabilities (USN-6445-1)
199858 Ubuntu Security Notification for Linux kernel (Intel IoTG) Vulnerabilities (USN-6445-2)
199879 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6464-1)
199883 Ubuntu Security Notification for Linux kernel (NVIDIA) Vulnerabilities (USN-6466-1)
199957 Ubuntu Security Notification for Linux kernel (StarFive) Vulnerabilities (USN-6520-1)