---
id: CVE-2023-52442
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: validate session id and tree id in compound request

  `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session()
  will always return the first request…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: validate session id and tree id in compound request

  `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session()
  will always return the first request…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.15, < 5.15.145'
  - 'linux_kernel >= 5.16, < 6.1.53'
  - 'linux_kernel >= 6.2, < 6.4.16'
  - linux_kernel = 6.5
patched:
  - linux_kernel 6.4.16
published: '2024-02-21'
updated: '2026-08-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-52442'
references:
  - url: 'https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/017d85c94f02090a87f4a473dbe0d6ee0da72693'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/3df0411e132ee74a87aa13142dfd2b190275332e'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/4c2b350b2e269e3fd17bbfa42de1b42775b777ac'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/becb5191d1d5fdfca0198a2e37457bbbf4fe266f'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.29644
epssPercentile: 0.98131
ingestedAt: '2026-08-04T10:39:37.672Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate session id and tree id in compound request

`smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session()
will always return the first request smb2 header in a compound request.
if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will
return 0, i.e. The tree id check is skipped.
This patch use ksmbd_req_buf_next() to get current command in compound.

## Affected

- `linux_kernel >= 5.15, < 5.15.145`
- `linux_kernel >= 5.16, < 6.1.53`
- `linux_kernel >= 6.2, < 6.4.16`
- `linux_kernel = 6.5`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.4.16`