Trend Micro’s Zero Day Initiative (ZDI) has reported two remote code execution flaws in KSMBD, the Linux kernel’s built-in SMB file-sharing server, and both landed on public kernel mailing lists without a patch. ZDI rates each 9.0 on the CVSS scale. According to The Hacker News, which broke down the reports on October 22, neither flaw has a named fix in the mainline kernel or in linux-next, the tree that feeds it.
ZDI-CAN-33774 needs no authentication: any server running KSMBD and reachable on port 445 is exposed. It is a race in how KSMBD picks its protocol handler. A burst of short SMB1 packets followed by an SMB2 packet in the same TCP write can make workers handle SMB1 data with the SMB2 handler and read past the end of the buffer; a path to writing past it also exists once an attacker has access to a share. ZDI-CAN-33549 is narrower: an integer underflow in the SMB Direct path that needs an RDMA-capable network interface (hardware, or the rxe software driver), a writable KSMBD share and a client negotiating SMB Direct.
Neither flaw has a CVE identifier yet, because the kernel project assigns those only once a stable-tree fix exists. The Hacker News cites Phoronix saying SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 aimed at the next kernel development cycle, but notes this is not confirmed elsewhere, and that fixes in mainline typically take weeks to reach stable branches and distribution kernels. The reports reached public lists because the kernel’s security documentation, updated in May 2026, treats bugs found by AI tools as already public; ZDI credits TrendAI, Trend Micro’s AI scanner, as the finder. Stable-kernel maintainer Greg Kroah-Hartman objected to reports sent that way: in replies The Hacker News quotes, to the VMware GPU and NVMe reports, he wrote that they went to public lists without a patch and asked ZDI to fix its submission process.
The same batch included three unrelated kernel reports (a networking local privilege escalation, a VMware GPU driver local privilege escalation, and an NVMe target information disclosure); none affect KSMBD servers.
How to check if you’re affected
Affected products are Linux servers that have the KSMBD kernel module active. The Hacker News says systemctl status ksmbd or lsmod | grep ksmbd confirms whether it is running. Red Hat Enterprise Linux does not include KSMBD by default, per Red Hat’s support documentation.
- If the module is not loaded, these two flaws do not apply to that server.
- If it is loaded and port 445 is reachable from untrusted networks, that is the exposure for ZDI-CAN-33774, which needs no login. The sources name no workaround or patched kernel version yet; as our own reading, limiting who can reach port 445 or unloading KSMBD where you do not need it reduces exposure until fixes ship.
- ZDI-CAN-33549 additionally requires an RDMA-capable interface and a writable share, so servers without RDMA are not exposed to that one.
- Watch your distribution’s kernel advisories and the kernel CVE feed: CVE ids and stable-kernel fixes are expected only after a fix lands.