Linux kernel KSMBD (in-kernel SMB server): two remote code execution flaws rated CVSS 9.0 by Trend Micro's Zero Day Initiative, one reachable without authentication, were reported on public kernel mailing lists with no mainline fix yet, according to The Hacker News (22 Oct)
Trend Micro's Zero Day Initiative (ZDI) lists two Linux vulnerabilities, ZDI-CAN-33549 and ZDI-CAN-33774, each rated CVSS 9.0 and reported to the vendor on 21 October 2026. According to The Hacker News (22 Oct), both are remote code execution flaws in KSMBD, the Linux kernel's built-in SMB server, and were sent to public mailing lists without patches. The Hacker News says ZDI-CAN-33774 needs no authentication and exposes any server running KSMBD on port 445: a race in how KSMBD assigns its handler table lets a burst of short SMB1 packets followed by an SMB2 packet make workers read past the end of a buffer, with a path to writing past it once an attacker has access to a share. It says ZDI-CAN-33549 is an integer underflow in KSMBD's SMB Direct path that needs an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share and a client negotiating SMB Direct. According to The Hacker News, as of Thursday 22 October neither flaw had a named fix in the mainline kernel or linux-next, and neither has a CVE, since the kernel assigns CVEs only after a stable-tree fix. Phoronix (22 Oct) says a patch for ZDI-CAN-33549 sits in a Git branch intended for Linux 7.5, and that the reports appear to have been sent to the public list by mistake. The Hacker News says Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's documentation. No exploitation has been reported. Sources: ZDI upcoming advisories; The Hacker News (22 Oct); Phoronix (22 Oct).
- Product
- Linux kernel — KSMBD in-kernel SMB server (including the SMB Direct / RDMA transport)
- Versions
- Linux kernels running KSMBD; no CVE and no fixed mainline or stable kernel as of 22 Oct (per The Hacker News); a patch for ZDI-CAN-33549 sits in a Git branch intended for Linux 7.5 (per Phoronix). ZDI-CAN-33549 also needs SMB Direct over an RDMA-capable interface.
- CVSS
- 9.0 (ZDI rating, both flaws; no CVE assigned)
- Exploited in Australia?
- unknown
- Patch to
- No fixed kernel yet (as of 22 Oct). Check whether KSMBD is active (systemctl status ksmbd or lsmod | grep ksmbd, per The Hacker News); where you do not need it, stop the service and unload the module, and do not expose TCP 445 on KSMBD hosts to untrusted networks. Watch your distribution for kernel updates that name these issues.
Primary: Zero Day Initiative — Upcoming advisories (ZDI-CAN-33549 and ZDI-CAN-33774, Linux, CVSS 9.0, reported 21 Oct 2026) · The Hacker News — Two CVSS 9.0 Linux KSMBD RCE flaws disclosed on public mailing lists before kernel fixes (22 Oct 2026) · Phoronix — Several Linux kernel vulnerabilities accidentally posted to public kernel mailing list (22 Oct 2026)