Description

On October 21–22, 2026, Trend Micro's Zero Day Initiative (ZDI) publicly disclosed two remote code execution vulnerabilities in KSMBD, the in-kernel SMB server for Linux. Tracked under internal advisory IDs ZDI-CAN-33774 and ZDI-CAN-33549, both vulnerabilities are rated with a CVSS score of 9.0. These are unpatched vulnerabilities (0-days) disclosed prior to an official fix being made available.

ZDI-CAN-33774 is a race condition flaw in how KSMBD assigns handler tables: sending SMB1 and SMB2 packets in a single TCP write can cause the worker to process SMB1 data using the SMB2 handler, leading to out-of-bounds reads beyond a smaller buffer and potential out-of-bounds writes. Notably, this vulnerability can be triggered without authentication, targeting any server running KSMBD with port 445 exposed.

ZDI-CAN-33549 is an integer underflow flaw in KSMBD's SMB Direct: clients can send RDMA buffer descriptors where the first element is larger than the declared payload, wrapping the server's size counter and causing subsequent copy operations to write out of bounds. This vulnerability has a narrower exploitation condition: it requires network communication supporting RDMA (either hardware or the rxe software driver), a KSMBD share permitting write access, and the client using SMB Direct.

  • CVSS Score: 9.0 (both vulnerabilities)

  • Severity: Critical (according to ZDI); no CVE assigned yet and not yet scored by the NVD

  • Status: Unpatched vulnerability (0-day) at the time of writing

Scope of Impact

The vulnerabilities affect Linux systems with the KSMBD module enabled for file sharing over SMB. The level of exposure depends on configuration:

  • ZDI-CAN-33774 (Unauthenticated): Any system running KSMBD with port 445 exposed to the network; this represents a wider risk surface.

  • ZDI-CAN-33549 (Requires SMB Direct/RDMA): Systems utilizing SMB Direct over RDMA communication (hardware or rxe software driver) with writable KSMBD shares; commonly found in high-performance file-sharing data center environments.

  • Systems without KSMBD enabled: Not affected by these two vulnerabilities. Note that KSMBD is an in-kernel SMB server, distinct from Samba (smbd) which runs in userspace.

Note: Verify whether systems have the KSMBD module loaded rather than relying solely on CVE scanning tools. Information regarding affected kernel versions has not been fully disclosed.

Impact

Successful exploitation of the vulnerabilities can lead to:

  • Remote code execution in kernel context on servers running KSMBD, resulting in full system compromise.

  • For ZDI-CAN-33774, unauthenticated attacks requiring only network access to port 445 of the server.

  • Kernel memory corruption (out-of-bounds read/write), which may cause system crashes (DoS) even if full code execution is not achieved.

Mitigation

  • Identify whether systems are using KSMBD. If KSMBD is not strictly necessary, unload and disable the module to eliminate the attack surface (e.g., stop the ksmbd service, run rmmod ksmbd, and prevent automatic reloading); consider using userspace Samba if SMB sharing is required.

  • If KSMBD must remain in use, restrict access to port 445 using a firewall, allowing only trusted networks/hosts, and place servers behind a VPN until an official patch is released (mitigation for ZDI-CAN-33774).

  • For ZDI-CAN-33549: If SMB Direct/RDMA is not required, disable SMB Direct or avoid configuring RDMA communication (including the rxe software driver); review and restrict write permissions on KSMBD shares.

  • Monitor for official patches: update the kernel from your distribution vendor as soon as fixes are pushed to stable branches and CVEs are assigned; in the meantime, monitor logs and abnormal crash behavior of the KSMBD service.

References

https://www.zerodayinitiative.com/advisories/upcoming/

https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html

https://www.phoronix.com/

https://www.kernel.org/category/releases.html