Linux Kernel ksmbd Null Pointer Dereference Vulnerability in Kerberos Session Handling

A null pointer dereference vulnerability has been identified in the Linux kernel's ksmbd component, specifically during the handling of Kerberos sessions. When a client sets the PreviousSessionId during the Kerberos session setup, it can lead to a null pointer dereference error. This occurs because the session's user information is not yet populated, allowing a null user argument to be passed to the destroy_previous_session function. The vulnerability has been addressed by modifying the sequence of function calls, ensuring that the user information is set before attempting to destroy the previous session.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, causing a crash or undefined behavior in the application.