Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Six ZDI Reports Landed on the Public Linux Kernel Mailing List

Between 21 and 22 October 2026, Trend Micro's Zero Day Initiative (ZDI) submitted six vulnerability reports to the public Linux Kernel Mailing List (LKML) rather than the private security channel. Two of those reports target KSMBD, the kernel's built-in SMB file server, and both were rated CVSS 9.0 remote code execution flaws. As of 23 October 2026, neither flaw had a CVE identifier or a named fix in the mainline kernel or linux-next.

Tracking IDs and Trigger Conditions

The first flaw, ZDI-CAN-33774, is a race condition in KSMBD's protocol dispatch. KSMBD selects the per-connection protocol operations when it enqueues each PDU, but the worker reads those operations only when it later dequeues the work. An attacker can send a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write, switching the connection from SMB1 to SMB2 handling while SMB1 buffers are still waiting, so the SMB2 code reads past the end of the smaller SMB1 buffer. This flaw can be triggered without authentication over TCP port 445 on any server running KSMBD.

The second flaw, ZDI-CAN-33549, is an integer underflow in KSMBD's SMB Direct (RDMA) path that can lead to a memory-copy buffer overrun. Triggering it requires an RDMA-capable interface (hardware or the rxe software implementation), a writable KSMBD share, and a client negotiating SMB Direct. Its CVSS vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.

Disclosure Came Before the Fix

ZDI was expected to send the reports through the private security channel, but they ended up on the public mailing list, exposing vulnerability details before maintainers could merge fixes. ByteIota described the posting as an accidental publication of six Linux kernel vulnerability reports to the public LKML instead of the private security channel. Cyber Kendra reported that ZDI sent the six reports to the public Linux kernel mailing lists on 21 and 22 October 2026, before any fixes existed.

Scope and Who Should Worry

Most Linux servers running Samba are not affected by these two CVSS 9.0 bugs; the scope is specific to KSMBD and SMB Direct (RDMA) users. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation. Administrators can confirm exposure with `systemctl status ksmbd` or `lsmod | grep ksmbd`. Phoronix reported that a maintainer submitted a fix for ZDI-CAN-33549 for the next kernel development cycle, though that was not confirmed elsewhere.

Fixes and What Comes Next

At the time of reporting, neither flaw had a named mainline kernel fix or a linux-next fix. Intel Threadlinqs noted that a fix for ZDI-CAN-33549 was reportedly submitted by Stefan Metzmacher for the next kernel cycle but had not yet merged. Softzone.es reported that a patch for ZDI-CAN-33549 already exists in a git branch intended for Linux v7.5, and its arrival in mainline may accelerate now that the issue is public. The Linux project typically assigns CVEs only after fixes land in the stable tree. Intel Threadlinqs also noted that no active exploitation or public proof-of-concept had been reported, but advised KSMBD users to assess exposure immediately.