diff --git a/fs/smb/server/auth.c b/fs/smb/server/auth.c
index 2f89af029247..bcd371f5550d 100644
--- a/fs/smb/server/auth.c
+++ b/fs/smb/server/auth.c
@@ -729,7 +729,7 @@ static int ksmbd_get_encryption_key(struct ksmbd_work *work, __u64 ses_id,
 		 * that the command can reach the session setup handler. Other
 		 * commands are rejected there with STATUS_NETWORK_SESSION_EXPIRED.
 		 */
-		sess = ksmbd_session_lookup(work->conn, ses_id);
+		sess = ksmbd_session_lookup_all_states(work->conn, ses_id);
 		if (sess && sess->state != SMB2_SESSION_VALID &&
 		    (sess->state != SMB2_SESSION_EXPIRED ||
 		     !sess->kerberos_expiry)) {
diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c
index f4675c457714..31eccad5d732 100644
--- a/fs/smb/server/mgmt/user_session.c
+++ b/fs/smb/server/mgmt/user_session.c
@@ -551,11 +551,18 @@ struct ksmbd_session *ksmbd_session_lookup_all_states(struct ksmbd_conn *conn,
 						      unsigned long long id)
 {
 	struct ksmbd_session *sess;
+	bool channel_found;
 
 	sess = ksmbd_session_lookup(conn, id);
-	if (!sess && conn->binding) {
+	if (!sess) {
 		sess = ksmbd_session_lookup_slowpath(id);
-		if (sess && !xa_load(&sess->ksmbd_chann_list, (long)conn)) {
+		if (!sess)
+			return NULL;
+
+		down_read(&sess->chann_lock);
+		channel_found = xa_load(&sess->ksmbd_chann_list, (long)conn);
+		up_read(&sess->chann_lock);
+		if (!channel_found) {
 			ksmbd_user_session_put(sess);
 			sess = NULL;
 		}