Two Critical RCE Flaws in Linux KSMBD Disclosed Publicly Ahead of Kernel Fixes
Two severe remote code execution vulnerabilities in Linux's kernel SMB server (KSMBD) have been publicly disclosed, carrying CVSS scores of 9.0 and lacking immediate patches.
Two critical remote code execution vulnerabilities, each with a CVSS score of 9.0, have been publicly disclosed for Linux's kernel SMB server (KSMBD). These flaws, tracked as ZDI-CAN-33774 and ZDI-CAN-33549 by Trend Micro's Zero Day Initiative (ZDI), pose a significant risk as no patches are currently available in the mainline Linux kernel.
The first vulnerability, ZDI-CAN-33774, is particularly concerning as it can be exploited without requiring any prior network authentication. This means any Linux server running KSMBD and exposed on port 445 is potentially vulnerable. The flaw arises from a race condition in how KSMBD handles incoming packets. A rapid succession of short SMB1 packets followed by an SMB2 packet within the same TCP write can cause the server to misinterpret the data, leading to a buffer overflow when processing SMB1 data with an SMB2 handler. A secondary path to overwriting memory also exists if an attacker gains access to a writable share.
The second vulnerability, ZDI-CAN-33549, targets the SMB Direct transport protocol and requires an RDMA-capable network interface. This flaw is an integer underflow within KSMBD's SMB Direct path. Attackers can craft malicious RDMA buffer descriptors where the first descriptor indicates a larger buffer than the actual payload. This manipulation causes the server's size counter to wrap around, leading to a memory copy operation that overflows the allocated buffer. Exploitation necessitates an RDMA-capable interface (either hardware or the rxe software driver), a share that KSMBD can write to, and a client that negotiates SMB Direct.
As of the disclosure, neither vulnerability has a corresponding fix merged into the mainline Linux kernel or the linux-next integration tree. While reports suggest that the SMB Direct maintainer, Stefan Metzmacher, has submitted a fix for ZDI-CAN-33549 targeting the upcoming kernel development cycle, this has not been officially confirmed. Typically, fixes take several weeks to propagate from the mainline kernel to stable branches and subsequently to distribution-specific kernels.
Neither of these vulnerabilities has been assigned a CVE identifier yet. The Linux kernel project generally assigns CVEs only after a stable fix is available. Administrators can check if KSMBD is active on their systems by running systemctl status ksmbd or lsmod | grep ksmbd. Notably, Red Hat Enterprise Linux does not include KSMBD by default, according to its support documentation.
Both vulnerabilities were identified by TrendAI, Trend Micro's AI-powered scanner. The ZDI's disclosure process followed the Linux kernel's security documentation, updated in May 2026, which advises that AI-discovered bugs should be sent to subsystem developer mailing lists. ZDI appears to have copied these public lists alongside the private kernel security address, but without providing patches in their initial reports.
This disclosure method drew a sharp response from stable kernel maintainer Greg Kroah-Hartman, who commented on similar submissions for unrelated vulnerabilities. He expressed frustration with reports sent to public lists without accompanying patches, stating, "For some reason you sent this to public lists, and did not include a patch, so there's not much we can do with this." This highlights ongoing discussions within the kernel community regarding the optimal disclosure process for vulnerabilities, especially those found by automated tools.
Beyond the KSMBD flaws, ZDI also reported other vulnerabilities affecting different Linux kernel subsystems. These include a local privilege escalation in the networking stack (ZDI-CAN-33367), a local privilege escalation in the VMware virtual GPU driver (ZDI-CAN-34068), and an information disclosure in the NVMe target driver (ZDI-CAN-34076). A separate report detailed a buffer overflow in ConnMan, a network management daemon outside the kernel. However, only the two KSMBD vulnerabilities present a direct remote code execution risk to servers running the kernel SMB server.