Two critical Linux KSMBD remote code execution flaws made public before kernel fixes

Two remote code execution vulnerabilities in KSMBD, the in-kernel SMB file server in Linux, have been disclosed on public mailing lists before any fix landed in the mainline kernel, The Hacker News reported on October 22. Trend Micro's Zero Day Initiative (ZDI) rated both flaws 9.0 on the CVSS scale, and one of them can be reached without authentication over port 445, leaving servers that run KSMBD exposed while a patch is still pending.

What happened

According to The Hacker News, the ZDI reports credit TrendAI, Trend Micro's AI-based scanner, with finding the bugs. ZDI copied public kernel mailing lists alongside the private kernel security address and attached no patches. The outlet linked this to the kernel's security documentation, updated in May 2026, which says bugs found by AI tools should be treated as already public and sent to subsystem developer lists.

The approach drew criticism from stable kernel maintainer Greg Kroah-Hartman, who said on one report that there was "not much we can do" without a patch and on another asked ZDI to "fix your submission process," The Hacker News reported.

Technical details

The more serious of the two, ZDI-CAN-33774, sits in KSMBD's protocol dispatch code and requires no authentication. The Hacker News described it as a race condition in how KSMBD assigns its handler table: a specific mix of SMB1 and SMB2 traffic can cause SMB1 data to be processed by an SMB2 handler, reading past the end of a shorter buffer. The article said a path to writing past the buffer also exists once an attacker has access to a share.

The second flaw, ZDI-CAN-33549, is an integer underflow in the SMB Direct path that can lead to a buffer overrun. Its exploitation is more constrained: it requires an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share and a client that negotiates SMB Direct.

Who is affected

Only systems that run KSMBD are exposed. The Hacker News did not list affected kernel versions. Neither flaw has a CVE identifier yet, because the kernel project assigns CVEs only after a fix reaches a stable tree. Phoronix reported that SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 targeting the next development cycle, which The Hacker News said it could not confirm elsewhere; no fix was mentioned for ZDI-CAN-33774. Fixes typically take weeks to reach stable branches and distribution kernels.

The same ZDI batch also included several unrelated kernel bugs, including local privilege escalation issues in networking and the VMware GPU driver and an information disclosure flaw in the NVMe target driver.

What to do

Administrators should first determine whether KSMBD is in use, for example with systemctl status ksmbd or lsmod | grep ksmbd. The Hacker News noted that Red Hat Enterprise Linux does not include KSMBD by default. The article did not give an official workaround, but systems that do not need the in-kernel SMB server can reduce exposure by not running it, and those that do should limit access to port 445 to trusted networks and apply kernel updates from their distribution as soon as fixes become available.