Linux KSMBD: Two CVSS 9.0 pre-auth/transport RCE flaws disclosed publicly before kernel fixes available
Severity: critical · Patch status: unpatched · Since 2026-10-22
Trend Micro's Zero Day Initiative publicly disclosed two CVSS 9.0 remote code execution flaws in the Linux kernel's KSMBD SMB server before fixes exist in the mainline kernel. ZDI-CAN-33774 is a protocol-dispatch race exploitable without authentication by any client reaching port 445, with a buffer-write path available to share users. ZDI-CAN-33549 is an integer underflow in the SMB Direct path requiring an RDMA-capable interface, a writable share, and SMB Direct negotiation. Neither flaw has a CVE or confirmed mainline fix; a fix for ZDI-CAN-33549 may land in the next dev cycle. Any Linux server running KSMBD is affected; RHEL does not ship it by default. No in-the-wild exploitation is known. Fixes will take weeks to reach stable and distribution kernels.
What to do
- Check whether KSMBD is active (systemctl status ksmbd or lsmod | grep ksmbd) and disable/unload the module or block port 445 if not strictly needed
- Restrict network access to KSMBD port 445 to trusted clients only via firewall rules
- Ensure KSMBD shares are read-only where possible and disable SMB Direct/RDMA transport if not required
- Monitor for kernel stable updates and apply the KSMBD fixes as soon as they reach your distribution
- Consider alternative SMB servers (e.g., Samba) for exposed file-sharing workloads until patches ship
Sources
All live incidents on Threat Watch
