In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix null pointer dereference in destroyprevioussession
If client set ->PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess->user is not set yet, It can pass the user argument as NULL to destroyprevioussession. sess->user will be set in ksmbdkrb5authenticate(). So this patch move calling destroyprevioussession() after ksmbdkrb5authenticate().