Two Linux KSMBD remote code execution vulnerabilities have been publicly disclosed, each rated CVSS 9.0. KSMBD is the Linux kernel’s built-in SMB server, and neither flaw had a fix in the mainline kernel or its integration tree, linux-next, as of October 22, 2026.
The vulnerability tracked as ZDI-CAN-33774 affects KSMBD’s handling of SMB protocol requests. A burst of short SMB1 packets followed by an SMB2 packet in the same TCP write can cause worker processes to use an SMB2 handler on SMB1 data. This may result in an out-of-bounds read. A related route to an out-of-bounds write may be possible for an attacker with access to a share.
The issue requires no authentication, potentially exposing any KSMBD server listening on port 445.
ZDI-CAN-33549 is an integer underflow in KSMBD’s SMB Direct transport. A client can provide RDMA buffer descriptors where the first buffer is larger than the declared payload. This can make the server’s size counter wrap, enabling a later memory copy to exceed an allocated buffer.
Exploitation requires an RDMA-capable interface—either hardware or the software rxe driver—along with a writable KSMBD share and a client using SMB Direct.
As of Thursday, neither issue had a named fix in the mainline kernel or linux-next. Linux news site Phoronix reported that SMB Direct maintainer Stefan Metzmacher had submitted a fix for ZDI-CAN-33549 for a future kernel development cycle, though that report had not been independently confirmed.
Even after a fix reaches mainline, stable kernel branches and distribution releases generally follow later. Neither flaw has a CVE identifier; the kernel project assigns CVEs after a fix becomes available in a stable tree.
Administrators can check whether KSMBD is active with systemctl status ksmbd or lsmod | grep ksmbd. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat documentation.
Trend Micro’s Zero Day Initiative credited its TrendAI scanner with finding the flaws. The ZDI reports were sent to public mailing lists as well as the kernel’s private security address, but did not include patches.
The Linux kernel’s security documentation says that vulnerabilities identified by AI tools are considered public and should be reported to the relevant subsystem mailing lists. Stable-kernel maintainer Greg Kroah-Hartman criticized the submission process in replies to other reports, noting that they had been sent to public lists without patches.
Three of five other kernel reports discussed in the same batch were unrelated to KSMBD: a local privilege escalation in the networking stack, a local privilege escalation in the VMware virtual GPU driver, and an information disclosure flaw in the NVMe target driver. A separate report concerned a buffer overflow in ConnMan, a network daemon outside the Linux kernel.
The two KSMBD reports are available for ZDI-CAN-33549 and ZDI-CAN-33774.
ChicagoVPS is your gateway to unparalleled hosting solutions. Our state-of-the-art datacenters and powerful network ensures lightning-fast speeds and uninterrupted connectivity for your websites and applications. Whether you’re a startup looking for scalable resources or an enterprise in need of enterprise-grade hosting, our range of plans and customizable solutions guarantee a perfect fit. Trust in ChicagoVPS to deliver excellence, combining unmatched reliability and top-tier support.
For Inquiries or to receive a personalized quote, please reach out to us through our contact form here or email us at sales@chicagovps.net.
