Unpatched KSMBD Flaws Expose Linux Servers to RCE Attacks

According to an October 22, 2026 report by The Hacker News, two remote code execution vulnerabilities assigned a 9.0 severity rating by Trend Micro’s Zero Day Initiative affect Linux servers utilizing KSMBD, the built-in SMB server of the kernel. Neither vulnerability carries a named fix in the mainline kernel or in the linux-next integration tree, leaving systems exposed as security researchers and developers debate disclosure protocols.

Zero-Day Vulnerabilities in KSMBD and SMB Direct

The two remote code execution flaws carry a CVSS severity rating of 9.0 out of 10. The first issue, tracked as ZDI-CAN-33774, can be triggered prior to any network authentication and exposes any server running KSMBD on port 445. The issue arises from a race condition within the KSMBD handler table allocation mechanism; specifically, when a TCP write delivers a rapid sequence of brief SMB1 packets immediately followed by an SMB2 packet, worker threads process the SMB1 payload using an SMB2 handler, which results in reads exceeding the boundaries of the shorter buffer. A path to writing past the buffer also opens up once an attacker gains access to a share.

The second vulnerability, designated ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network interface. This flaw is an integer underflow in the SMB Direct path of KSMBD. A client can supply RDMA buffer descriptors where the first descriptor is longer than the declared payload. This causes the server size counter to wrap, allowing a subsequent memory copy to overrun the end of an allocated buffer. Exploiting ZDI-CAN-33549 requires three specific conditions: an RDMA-capable interface using either hardware or the rxe software driver, a writable KSMBD share, and a client negotiating SMB Direct.

Kernel Patch Status and Maintainer Responses

As of October 22, 2026, neither flaw has a CVE identifier, because the Linux kernel project assigns those identifiers only after a stable-tree fix becomes available. Phoronix, a Linux-focused news publication, noted that Stefan Metzmacher, the SMB Direct maintainer, had provided a patch for ZDI-CAN-33549 aimed at the upcoming kernel development cycle, though other sources have yet to verify this claim. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat support documentation.

Administrators can confirm whether the module is active on their systems by running systemctl status ksmbd or lsmod | grep ksmbd. The Zero Day Initiative reports credit TrendAI, an AI scanner built by Trend Micro, as the discoverer of the issues.

The public disclosure of these bugs on mailing lists followed updated Linux kernel security documentation from May 2026, which incorporated guidance from Linus Torvalds stating that bugs found by AI tools are, by definition, already public and should be sent directly to subsystem developer lists. Following this logic, ZDI copied public mailing lists alongside the private kernel security address without attaching patches.

Stable-kernel maintainer Greg Kroah-Hartman responded critically to the unpatched public submissions. Replying to a separate report on the VMware GPU driver, he wrote:

For some reason you sent this to public lists, and did not include a patch, so there's not much we can do with this.

Greg Kroah-Hartman

Seventeen seconds later, regarding the NVMe driver report, he added:

Again, no patch, and sent to a public list? Please fix your submission process.

Greg Kroah-Hartman