Two CVSS 9.0 KSMBD Remote Code Execution Flaws Reported Before Kernel Fixes
Summary
Two publicly reported KSMBD remote code execution flaws are rated CVSS 9.0. One requires no authentication; the other requires SMB Direct and RDMA. Neither had a named mainline kernel fix at the time of reporting.
Key points
- ZDI-CAN-33774 is an unauthenticated race condition that can be triggered by SMB packets sent over TCP port 445.
- ZDI-CAN-33549 is an integer underflow in KSMBD's SMB Direct path that can lead to a memory-copy buffer overrun.
- Exploiting ZDI-CAN-33549 requires an RDMA-capable interface, a writable KSMBD share, and a client negotiating SMB Direct.
- As reported, neither flaw had a named fix in the mainline kernel or linux-next.
- Phoronix reported that a maintainer submitted a fix for ZDI-CAN-33549 for the next kernel development cycle; the article says this was not confirmed elsewhere.
- The article says fixes reaching mainline typically take weeks to reach stable branches and distribution kernels.
- The commands `systemctl status ksmbd` and `lsmod | grep ksmbd` can be used to check whether the KSMBD module is active.
Article Details
- Vulnerability Types
- Remote code execution
- Integer underflow
- Race condition
- Out-of-bounds read
- Out-of-bounds write
- Severity
- CVSS 9.0
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- unavailable
People
Greg Kroah-HartmanStable-kernel maintainer who replied to kernel reports that had been sent to public mailing lists without patches.Linus TorvaldsReferenced in connection with guidance in Linux kernel security documentation about handling bugs found by AI tools.p1r0xResearcher credited with discovering ZDI-CAN-33367, a local privilege-escalation flaw unrelated to KSMBD.Stefan MetzmacherSMB Direct maintainer reportedly submitted a fix for ZDI-CAN-33549 targeting the next kernel development cycle; this was not confirmed elsewhere.
Vendors
Red HatRunning systemctl status ksmbd or lsmod | grep ksmbd confirms whether the module is active. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation.Trend MicroLinux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.
Products
ConnManA sixth ZDI report, ZDI-CAN-32005, is a buffer overflow in ConnMan, a network daemon separate from the Linux kernel.ksmbdLinux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.LinuxLinux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.Red Hat Enterprise LinuxRunning systemctl status ksmbd or lsmod | grep ksmbd confirms whether the module is active. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation.VMware virtual GPU driverstack that requires local access. ZDI-CAN-34068 is a local privilege escalation in the VMware virtual GPU driver, ZDI-CAN-34076 is an information disclosure in the NVMe target driver, and neither affects KSMBD
Tools
rxeIt requires three things: an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share, and a client negotiating SMB Direct.TrendAIThe ZDI reports credit TrendAI, Trend Micro's AI scanner, as the finder. The Linux kernel's security documentation, updated in May 2026 following guidance from Linus Torvalds, states that bugs found by AI tools are, by