Linux KSMBD: two CVSS 9.0 RCE flaws made public before patches

After PwnEscape, the network stack flaw that let a guest VM read host memory, another pair of critical Linux kernel defects has gone public before fixes reached the distributions. This time it concerns KSMBD, the SMB server built into the kernel, and it is reachable over the network.

According to ICT Security Magazine, which followed the threads on the kernel development lists, the reports of two remote code execution vulnerabilities were made public on 21 October 2026. Both carry a CVSS 9.0 score assigned by Trend Micro’s Zero Day Initiative (ZDI), not by NVD, and neither has a CVE yet. The Hacker News (22 October) and Infosecurity Magazine (26 October) also covered the story; we only know what The Hacker News wrote through the other sources.

The two vulnerabilities

ZDI’s upcoming advisories page lists ZDI-CAN-33774 and ZDI-CAN-33549, vendor “Linux”, added on 21 October 2026 with a disclosure deadline of 18 February 2027. The page does not name KSMBD: the technical details are in the reports sent to the lists. Both have the vector AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H: network attack, no credentials, no user interaction, but high complexity.

ZDI-CAN-33774 – protocol negotiation. The connection’s operations handler is chosen when the request is queued and read when it is processed. A short SMB1 request followed by an SMB2 request in the same TCP send can therefore be handled with the SMB2 functions and read past the end of its own buffer. The report also describes an out-of-bounds write path. Trigger conditions, according to the report: a race condition and a share with guest access.

ZDI-CAN-33549 – SMB Direct (RDMA). An integer underflow in the length calculation of buffer descriptors leads to writes beyond the allocated memory. It requires an RDMA device (in the test, the rxe software driver), a writable share and SMB Direct enabled. The report includes reproduction scripts and the source of a test client; it was tested on a 7.3-rc3 kernel with a guest share. Credit goes to Hyeontae Lee, working with the Zero Day Initiative.

In MITRE ATT&CK the scenario maps to T1210, Exploitation of Remote Services.

Fix status

• ZDI-CAN-33774: KSMBD maintainer Namjae Jeon replied on 22 October that the issue is already fixed by commit 68f410fa in his tree, which waits for negotiation to complete before reading another packet. That the commit fixes this exact defect is the maintainer’s statement.
• ZDI-CAN-33549: Stefan Metzmacher, who maintains SMB Direct, asked the researcher to test the for-7.5/smbdirect branch of his repository, writing that he believes the issue is already solved there. This is a hypothesis, not a confirmed fix.

Neither fix is in the mainline kernel. The kernel project assigns a CVE once a fix lands in a stable branch, and reaching distribution kernels normally takes weeks after upstream acceptance.

Why the details are already public

According to ICT Security Magazine, the reports were sent to the kernel’s private security address with the public lists in copy and without a patch; Greg Kroah-Hartman replied in the thread complaining, once again, about the missing patch and the public list. Sources differ on why: Phoronix, quoted by the magazine, describes the submission as apparently accidental; The Hacker News links it to the kernel security documentation updated in May 2026 on bugs found with artificial intelligence tools, a link the thread does not confirm.

Infosecurity Magazine places the story in a wider context: six Linux flaws made public before fixes, including one with a working exploit for root privileges and no merged fix. We only have the summary of that article: we do not know which the other flaws are.

Who is exposed

KSMBD is not enabled by default on the major distributions; according to The Hacker News, Red Hat Enterprise Linux does not ship it. The main exposure is on NAS devices, embedded systems and file servers where it has been enabled instead of Samba. ZDI-CAN-33549 also needs an RDMA device. The critical point is timing: the description of the defects and, for SMB Direct, reproduction code are public before a fixed release, and there are no CVEs yet to look for in scanners or advisories.

For Italian and European companies the risk concentrates on devices often outside the normal update cycle: departmental NAS, branch storage, appliances with vendor firmware. For NIS2 entities this falls under vulnerability and service exposure management; in healthcare, consider NAS devices holding reports, images or backups.

What to do now

1. Check whether KSMBD is running: lsmod | grep ksmbd and systemctl status ksmbd; check whether port 445 is served by KSMBD or by Samba.
2. Where it is not needed, stop it and blacklist the module.
3. Where it is needed, restrict port 445 with the firewall to trusted segments only, never expose it to the internet, and remove shares with guest access: the cost is interrupting the shares served by the kernel.
4. SMB Direct: check for RDMA devices and whether SMB Direct is enabled; if it is not needed, turn it off.
5. Ask NAS and appliance vendors whether their firmware uses KSMBD and when the fix will ship.
6. Follow distribution advisories for CVEs and backports: commit IDs may change at merge time.

The kernel project has published no official mitigations: these are containment measures. No indicators of compromise have been published; watch for kernel crashes or errors related to KSMBD and unexpected SMB connections from external addresses.

How ARXDOME helps

The ARX Sentry inventory reports the system, software, processes and ports of Linux servers running the agent: it helps find where KSMBD is running and what is listening on port 445. ARX Expose and ARX Scout show whether an SMB service is exposed on your public addresses, and ARX Scout alerts you when a previously closed port opens.

Last updated: 26 October 2026