Two Critical KSMBD Linux Flaws Disclosed Publicly With No Kernel Fix Yet

Linux servers running KSMBD, the kernel's built-in SMB server, face two publicly disclosed remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, and neither has a fix in the mainline kernel.

One flaw, ZDI-CAN-33774, needs no authentication and exposes any server running KSMBD on port 445. It involves a race in how KSMBD assigns its handler table: a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write causes workers to handle SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. The second, ZDI-CAN-33549, is an integer underflow in the SMB Direct path that requires an RDMA-capable interface, a writable KSMBD share and a client negotiating SMB Direct.

As of Thursday, neither flaw has a named fix in the mainline kernel or linux-next. Phoronix reported that SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 targeting the next kernel development cycle, but this has not been confirmed elsewhere. Neither flaw has a CVE identifier, since the kernel project assigns those only after a stable-tree fix is available.

The ZDI reports credit TrendAI, Trend Micro's AI scanner, as the finder. The kernel's security documentation, updated in May 2026 following guidance from Linus Torvalds, states that bugs found by AI tools are by definition already public and should go to subsystem developer lists. ZDI copied public mailing lists alongside the private kernel security address without attaching patches. Stable-kernel maintainer Greg Kroah-Hartman replied to three of five kernel reports within minutes, writing on the VMware GPU driver report: "For some reason you sent this to public lists, and did not include a patch, so there's not much we can do with this."

Three of the five kernel reports are unrelated to SMB: ZDI-CAN-33367 is a local privilege escalation in the networking stack, ZDI-CAN-34068 a local privilege escalation in the VMware virtual GPU driver, and ZDI-CAN-34076 an information disclosure in the NVMe target driver. A sixth report, ZDI-CAN-32005, is a buffer overflow in ConnMan, a network daemon separate from the Linux kernel. Administrators can check whether the module is active with systemctl status ksmbd or lsmod | grep ksmbd. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation.

Source: The Hackers News