Unpatched CVSS 9.0 Remote Code Execution Flaws in Linux KSMBD Publicly Disclosed Before Fixes

On October 21–22, 2026, Trend Micro's Zero Day Initiative (ZDI) disclosed two critical remote code execution vulnerabilities in the Linux kernel's KSMBD SMB server on public kernel mailing lists. Both are rated CVSS 9.0. Neither has a mainline kernel fix as of October 22, 2026, and no CVE identifiers have been assigned. The kernel project assigns CVEs only after a stable-tree fix exists.

KSMBD is the in-kernel SMB/CIFS server. It is not enabled by default on major distributions such as Red Hat Enterprise Linux, but it can be loaded as a module or built into custom kernels. Systems running KSMBD and exposing port 445 are in scope.

This post will be updated if CVE identifiers are assigned, mainline fixes land, or exploitation is observed in the wild.

At a Glance

ZDI-CAN-33774: Protocol Dispatch Race Condition (Unauthenticated)

This is a race condition in how KSMBD selects protocol handlers. An attacker can send a burst of short SMB1 packets followed immediately by an SMB2 packet in the same TCP write. Worker threads can end up processing SMB1 data with an SMB2 handler, reading past the end of the shorter buffer.

A write-past-buffer path also exists once an attacker has access to a share. The vulnerability requires no authentication and affects any server running KSMBD on port 445. It was tested on kernel 7.3-rc3.

ZDI-CAN-33549: Integer Underflow in SMB Direct (RDMA Required)

This flaw is an integer underflow in smbdirect_connection_rdma_xmit() in the SMB Direct (RDMA) path. A client can supply RDMA buffer descriptors where the first descriptor's length exceeds the declared payload. After the code clamps the length and sets the remaining buffer length to zero, it subtracts the original (unclamped) descriptor length. Because the variable is unsigned, this wraps around to a large value. A subsequent memory copy then overruns the allocated buffer.

Exploitation requires:

• An RDMA-capable network interface (hardware or the rxe software driver)
• A writable KSMBD share
• Negotiation of SMB Direct

The issue was demonstrated with a crafted SMB2 WRITE (RemainingBytes=8 plus two oversized descriptors) and confirmed via KASAN slab-out-of-bounds reports. Credit for this finding goes to HYEONTAE LEE working with ZDI / TrendAI.

A fix for ZDI-CAN-33549 was submitted by SMB Direct maintainer Stefan Metzmacher for the next kernel development cycle. It has not yet landed in mainline or the integration tree. Fixes typically take weeks to reach stable branches and distribution kernels after mainline acceptance.

Disclosure Context

The reports arrived on public lists (including LKML) alongside the private kernel security address. This aligns with Linux kernel security documentation updated in May 2026. Following guidance associated with Linus Torvalds, bugs found by AI tools are treated as public by definition because the same tools are widely available and often surface the same issues simultaneously. The documentation directs such reports to subsystem developer lists rather than the private security list by default.

Stable-kernel maintainer Greg Kroah-Hartman replied quickly to multiple ZDI reports, noting the public posting and lack of attached patches. The ZDI reports credit TrendAI (Trend Micro's AI scanner) as the finder for several of the issues.

Additional ZDI reports posted around the same time affect other subsystems (networking skb_zerocopy local privilege escalation, VMware GPU driver, NVMe target driver, and a separate ConnMan buffer overflow). Only the two KSMBD issues are the high-severity remote code execution cases relevant to SMB servers.

Impact and Exposure

The unauthenticated nature of ZDI-CAN-33774 makes it the more broadly concerning of the two for any system with KSMBD loaded and port 445 reachable. ZDI-CAN-33549 has a narrower attack surface because of the RDMA and writable-share requirements, but it is still a critical RCE in environments that use SMB Direct for high-performance file sharing.

KSMBD has a history of high-severity issues, including prior unauthenticated RCE and privilege-escalation bugs. Most production file-sharing deployments use userspace Samba rather than the in-kernel server, which limits real-world exposure. However, any host that has enabled KSMBD—whether for performance reasons, embedded systems, or testing—should treat these as active risks until patches are available and applied.

Recommended Actions

1. Determine whether KSMBD is active:

   lsmod | grep ksmbd
   systemctl status ksmbd
   

2. If the module is loaded and not required, unload it and blacklist it.

3. Ensure port 445 is not exposed to untrusted networks. Prefer firewall rules, network segmentation, or disabling the service entirely if SMB is not needed.

4. Monitor kernel mailing lists and distribution security advisories for patches. Mainline fixes, once accepted, will take additional time to reach stable and vendor kernels.

5. Prefer userspace Samba for production SMB sharing unless there is a specific, validated reason to use KSMBD.

These disclosures highlight ongoing tension between rapid AI-assisted vulnerability discovery and the kernel's preference for public discussion of non-secret findings. Until patches ship, the practical defense remains reducing exposure of the KSMBD attack surface.

Get unpatched-vulnerability alerts and exposure context as they drop with the Threat Landscape Platform — live advisories, IoC feeds, and an AI Assistant. Start free, no credit card required.