Two CVSS 9.0 KSMBD RCE Flaws Go Public on Mailing Lists Before Any Kernel Fix

Linux servers running KSMBD — the kernel's built-in SMB server — are exposed to two remote code execution flaws. Both were rated 9.0 by Trend Micro's Zero Day Initiative, and neither has a fix in the mainline kernel yet.

Two distinct bugs

The first, ZDI-CAN-33774, requires no authentication and threatens any server running KSMBD on port 445. It is a race in how KSMBD assigns its handler table: a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write makes worker threads process SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. Once an attacker has access to a share, a path to writing past the buffer opens up as well.

The second, ZDI-CAN-33549, is an integer underflow in the SMB Direct path. A client supplies RDMA buffer descriptors in which the first is longer than the declared payload, wrapping the server's size counter so that a later memory copy overruns an allocated buffer. The attack needs an RDMA-capable interface (hardware or the rxe software driver), a writable share, and a client negotiating SMB Direct.

No fixes yet

As of Thursday, neither flaw had a named fix in mainline or in linux-next. Phoronix reported that SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 targeting the next development cycle, but that is unconfirmed elsewhere. Neither bug has a CVE: the kernel project assigns those only after a stable-tree fix exists. You can check for the module with systemctl status ksmbd or lsmod | grep ksmbd; per Red Hat's documentation, RHEL does not ship KSMBD by default.

Found by AI, sent to public lists

Both flaws were found by TrendAI, Trend Micro's AI scanner. The kernel's security documentation, updated in May 2026 on guidance from Linus Torvalds, states that bugs found by AI tools are by definition already public and should go to subsystem developer lists. ZDI followed that logic, copying the reports to public mailing lists with no patches attached.

Stable-kernel maintainer Greg Kroah-Hartman replied to three of the five kernel reports within minutes of each other. On the VMware GPU driver report he wrote: "For some reason you sent this to public lists, and did not include a patch, so there's not much we can do with this." Seventeen seconds later, on the NVMe driver report: "Again, no patch, and sent to a public list? Please fix your submission process."

Three of the five kernel reports are unrelated to SMB: local privilege escalations in the networking stack (ZDI-CAN-33367) and the VMware virtual GPU driver (ZDI-CAN-34068), plus an information disclosure in the NVMe target driver (ZDI-CAN-34076). A sixth report, ZDI-CAN-32005, is a buffer overflow in ConnMan, a network daemon separate from the kernel.

Source: The Hacker News