Linux KSMBD Flaws Expose Servers to Remote Code Execution Attacks

Two publicly reported remote code execution bugs in KSMBD, the Linux kernel’s built-in SMB server, carry a CVSS score of 9.0 and — as of the latest public reporting — have no fixes in the mainline kernel.

Two high-severity KSMBD bugs at a glance

Trend Micro's Zero Day Initiative assigned two ZDI identifiers and 9.0 severity ratings to separate KSMBD defects: ZDI-CAN-33549 and ZDI-CAN-33774. Both were disclosed on public kernel mailing lists before mainline fixes existed. According to the reporting, ZDI-CAN-33774 can be triggered without any network authentication; ZDI-CAN-33549 requires the SMB Direct transport and an RDMA-capable network interface.

How each flaw can be triggered — technical specifics

ZDI-CAN-33549 is described as an integer underflow in KSMBD's SMB Direct path. A client can supply RDMA buffer descriptors where the first descriptor is longer than the declared payload; that causes the server’s size counter to wrap and permits a subsequent memory copy to overrun the end of an allocated buffer. Exploitation requires three conditions: an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share, and a client negotiating SMB Direct.

ZDI-CAN-33774 is a race in handler-table assignment that requires no authentication and therefore exposes “any server running KSMBD on port 445.” The mailing-list description says a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write can lead workers to process SMB1 data with an SMB2 handler, which can read past the end of the shorter buffer. The report also notes a path to writing past the buffer exists once an attacker has access to a share.

What patch status and kernel process look like now

As of the public reporting, neither flaw had a named fix in the mainline kernel or in linux-next, the integration tree that feeds mainline. The article cites Linux news site Phoronix as reporting that SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 targeting the next kernel development cycle, but notes that this has not been confirmed elsewhere.

The reporting also explains process consequences: the kernel project assigns CVE identifiers only after a stable-tree fix is available, so neither issue had a CVE at the time of disclosure. It adds that fixes to mainline typically take weeks to reach stable branches and distribution kernels afterward.

How these reports reached the kernel lists and the role of AI

TrendAI, Trend Micro's AI scanner, is credited as the finder in the ZDI reports. The Linux kernel’s security documentation — updated in May 2026 following guidance from Linus Torvalds — states that bugs found by AI tools are, by definition, already public and should be sent to subsystem developer lists. ZDI’s routing appears to have followed that guidance: the reports were copied to public mailing lists alongside the private kernel security address and were submitted without attached patches.

Stable-kernel maintainer Greg Kroah‑Hartman replied to three of five kernel reports within minutes. To one submission on the VMware GPU driver he wrote: “For some reason you sent this to public lists, and did not include a patch, so there's not much we can do with this.” Seventeen seconds later on another report he wrote: “Again, no patch, and sent to a public list? Please fix your submission process.”

Detection notes and distribution implications

Administrators can confirm whether KSMBD is active with the commands shown in the reporting: systemctl status ksmbd or lsmod | grep ksmbd. The article also cites Red Hat support documentation saying Red Hat Enterprise Linux does not include KSMBD by default. Given the kernel-release cadence noted above, the reporting emphasizes that distribution kernels will typically receive fixes only after mainline and stable branches incorporate them.

What this means for technologists, distribution maintainers, and adversaries

• Technologists and security teams: watch whether mainline or linux-next accept fixes and whether a stable-tree patch — and a subsequent CVE — appear. Use the provided checks to confirm whether KSMBD is running in your environments.
• Distribution maintainers and vendors: expect the normal lag between mainline fixes and distribution kernel updates; the reporting underscores that this interval “typically take[s] weeks.” Red Hat’s omission of KSMBD from default RHEL installs may alter exposure for RHEL customers.
• Adversaries and operators: ZDI-CAN-33774 requires no authentication and targets KSMBD on port 445, while ZDI-CAN-33549 needs SMB Direct and an RDMA-capable interface — differing operational requirements that affect which targets are attractive and feasible.

Neither defect had an assigned CVE or a confirmed mainline patch at the time of the reporting, leaving a narrow set of public facts and a clear next step: monitor linux-next and mainline trees for the fixes and for any subsequent stable-tree backports. The timeline for distribution updates will determine how long exposed systems remain at risk.

Original story: https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html