Vulnerabilities
Two serious Linux KSMBD flaws disclosed before kernel fixes
Two remote code execution flaws in Linux's KSMBD server were made public before any kernel fix was available. One can be triggered without authentication, exposing unpatched servers.
Ross Grant3 min read
The short version
Researchers found two serious security flaws in KSMBD, a file-sharing feature built into Linux. These flaws could let attackers run code on vulnerable servers, and one does not even require a password. The problems were made public before a fix was ready, so Linux servers running KSMBD are at risk until patches are released.
What happened?
Two remote code execution flaws in Linux's KSMBD server were publicly disclosed before any kernel fix was available, according to The Hacker News. One flaw can be triggered without authentication, exposing servers running KSMBD to potential attack. There is no fix yet in the mainline kernel.
How the flaw works
According to The Hacker News (opens in a new tab), two remote code execution (RCE) vulnerabilities have been disclosed in KSMBD, the SMB server built into the Linux kernel. Both flaws were rated 9.0 out of 10 on the CVSS scale by Trend Micro's Zero Day Initiative (ZDI). No fix is yet available in the mainline Linux kernel. These flaws were made public on mailing lists before patches were ready, which is unusual for such high-severity issues.
The first flaw, ZDI-CAN-33774, can be exploited before any network authentication. Attackers can send a burst of short SMB1 packets, then an SMB2 packet in the same TCP write. This tricks KSMBD into using the wrong handler, causing it to read past the end of a buffer. If the attacker has access to a share, they could potentially write past the buffer as well.
The second flaw, ZDI-CAN-33549, is an integer underflow in the SMB Direct path. It requires a server with an RDMA-capable network interface and a writable KSMBD share. By sending specially crafted RDMA buffer descriptors, an attacker can cause a memory copy to overrun the end of an allocated buffer, potentially leading to code execution.
Who is affected
Any Linux server running KSMBD is potentially at risk, especially those exposed to the internet on port 445. The first flaw does not require authentication, so any reachable server could be targeted. The second flaw requires more specific conditions: the server must support SMB Direct and have RDMA hardware or the rxe software driver, and the attacker must have write access to a share. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation.
The response
As of the report's publication, neither flaw has a fix in the mainline kernel or in linux-next (the integration tree for upcoming kernel changes). Linux news site Phoronix reported that a patch for ZDI-CAN-33549 was submitted for the next development cycle, but this has not been confirmed elsewhere. Fixes to the mainline kernel usually take weeks to reach stable releases and distribution packages.
The ZDI reports credit TrendAI, Trend Micro's AI scanner, as the finder. The Linux kernel's security policy, updated in May 2026, states that bugs found by AI tools are considered public and should be sent to developer mailing lists. ZDI followed this guidance, copying public lists and the private kernel security address, but did not attach patches to the reports. Kernel maintainers criticised the lack of patches and the public disclosure process.
What you should do
Admins can check if KSMBD is active by running systemctl status ksmbd or lsmod | grep ksmbd. If KSMBD is not needed, it should be disabled or uninstalled. Servers exposed to the internet should be firewalled to restrict access to port 445. Watch for security updates from your Linux distribution and apply patches as soon as they become available.
Claimed vs confirmed
- Unconfirmed
Two CVSS 9.0 Linux KSMBD RCE flaws were disclosed publicly before kernel fixes.
Reported by The Hacker News, not yet confirmed by Linux maintainers or other sources.
- Unconfirmed
One flaw can be triggered before authentication, exposing any server running KSMBD on port 445.
Reported by The Hacker News, not yet confirmed by Linux maintainers or other sources.
Why it matters
These flaws put unpatched Linux servers at risk of remote takeover, especially those exposed to the internet. The early public disclosure before a fix increases the risk of attacks. Admins need to check if they are running KSMBD and take steps to protect their systems.
Key points
- Two critical KSMBD flaws were disclosed before fixes were available.
- One flaw can be exploited without authentication, exposing many servers.
- No patch is yet available in the mainline Linux kernel.
- Admins should check if KSMBD is running and restrict access to port 445.
- Red Hat Enterprise Linux does not include KSMBD by default.
Sources
The Hacker News
Reference
