ksmbd: fix null pointer dereference in alloc_preauth_hash()
No sign of exploitation. No public exploitation artifact known so far.
A network client can bypass security checks by skipping the proper negotiation phase and sending a malformed request, allowing it to proceed to session setup even though the connection isn't fully initialized. This causes the server to crash or behave unpredictably.
The vulnerability exists in ksmbd's alloc_preauth_hash() function where a null pointer dereference occurs if a client sends a malformed SMB2 negotiate request followed by a session setup request before negotiate phase completion. The attack vector is remote over the network (SMB2 protocol); the server fails to validate that conn->preauth_info is allocated before use. The impact is denial of service or potential information disclosure.