Linux KSMBD RCE Flaws Disclosed Unpatched by Trend Micro ZDI

Trend Micro’s Zero Day Initiative (ZDI) sent six vulnerability reports to public Linux kernel mailing lists on 21 and 22 October 2026, before any fixes existed. Two of them are remote code execution flaws rated 9.0 on the CVSS scale in KSMBD, the kernel’s built-in SMB file server. One of the pair, ZDI-CAN-33774, can be triggered without logging in on any server running KSMBD on port 445. As of 23 October 2026, neither flaw has a fix in the mainline kernel or a CVE identifier.

The reports normally go to the kernel’s private security list, so maintainers can prepare a patch before details become public. This batch was copied to public lists as well, and none included a patch. Stable-kernel maintainer Greg Kroah-Hartman replied to several reports within minutes of each other.

What the two KSMBD flaws do

ZDI-CAN-33774 is a race condition in how KSMBD picks which protocol handler processes each incoming request. KSMBD chooses the handler when a request is queued, but the worker thread reads that choice only when it picks up the job. An attacker sends a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write.

That switches the connection to SMB2 handling while SMB1 buffers are still waiting, so the SMB2 code reads past the end of the smaller SMB1 buffer. Linux news site freenode reported that the leaked kernel heap bytes come back to the attacker inside an error .

ZDI also describes a related out-of-bounds write in KSMBD’s parsing of security descriptors, the access-control data a client sends when changing file permissions. That write path needs shared access. Freenode put the requirements as winning the race plus a reachable as a guest, and said the bug was demonstrated against kernel 7.3-rc3. The high attack-complexity rating in ZDI’s 9.0 score reflects the need to win that race.

ZDI-CAN-33549 is an integer underflow in KSMBD’s SMB Direct path. An integer underflow is a subtraction that wraps a size value around to a huge number. SMB Direct carries SMB traffic over RDMA (remote direct memory access), a networking technology mostly found in data centres. A client can send RDMA buffer descriptors in which the first entry is longer than the declared payload. The server’s size counter then wraps, and a later memory copy overruns its buffer. Exploiting it requires an RDMA-capable interface (hardware or the rxe software driver), a writable and a client that negotiates SMB Direct. SMB Direct support is a separate kernel build option that is off by default.

Phoronix reported that a fix for ZDI-CAN-33549 already sits in a Git branch aimed at Linux 7.5 and will likely be fast-tracked. The Hacker News found no named fix for either KSMBD bug in mainline or linux- . The kernel project assigns CVE numbers only after a fix lands in a stable tree. Until then, vulnerability scanners that match on CVE IDs will not flag these bugs.

The other four reports carry less risk for internet-facing servers:

ZDI-CAN-33367 is a local privilege escalation (CVSS 7.8) in the networking code’s skb_zerocopy function. Kernel developers had already received a report of the same bug from someone else the week, and a patch is expected.

ZDI-CAN-34068 is an out-of-bounds write (CVSS 8.8) in vmwgfx, the graphics driver used by VMware virtual machines.

ZDI-CAN-34076 is an information disclosure (CVSS 8.6) in the NVMe-over-fabrics target driver.

ZDI-CAN-32005 is a stack buffer overflow in ConnMan, a network-management daemon that runs outside the kernel.

An accident, or the new kernel rules at work?

Phoronix described the postings as an apparent mistake. The reports themselves suggest otherwise: they credit TrendAI, Trend Micro’s AI vulnerability scanner, as the finder. The kernel’s security-bugs documentation , rewritten by Willy Tarreau and merged for Linux 7.1 in May 2026, says bugs found with AI tools should be treated as already public and sent to the relevant maintainers instead of the private list.

That rule followed Linus Torvald’s 17 May complaint that duplicate AI-generated reports had made the private security list “almost entirely unmanageable.” His argument was that when one AI tool finds a bug, others running similar tools find it too, so secrecy buys little. The same guidance asks reporters to send patches or clear impact analysis, not raw findings. ZDI’s reports included neither patches nor fixes.

The ZDI-CAN-33367 duplicate shows the problem Torvalds described: another researcher had found the same bug a week earlier. The policy meant to cut duplicate private reports has also put two pre-patch, 9.0-rated server bugs in public view with no fix attached. Trend Micro had not publicly explained its routing as of 23 October 2026.

Is your Linux server affected?

Only systems actually running KSMBD are exposed to the two remote flaws. KSMBD is not Samba. It is a separate, Samba-compatible server written from scratch, originally by Samsung, and Samba’s co-creator, Jeremy Allison, has said the two no code. Ordinary Samba installations are unaffected.

KSMBD is off by default in the upstream kernel configuration. It also needs the separate ksmbd-tools userspace daemon to serve files. Red Hat Enterprise Linux does not include it . It turns up most often on NAS boxes, single-board computers and appliances, where it is chosen for low overhead. Kernels in the Armbian project for ARM boards, for example, enable it for many devices.

To check a machine, run systemctl status ksmbd or lsmod | grep ksmbd . If KSMBD is loaded but not needed, stop the service, unload it with modprobe -r ksmbd and blacklist the module so it does not load again. Where KSMBD has to stay:

Keep port 445 off the public internet.

Remove guest-accessible shares.

Leave SMB Direct disabled unless the network depends on RDMA.

Watch your distribution’s security tracker for the backported fix.

KSMBD has been a recurring ZDI target. ZDI-22-1690 in December 2022 was an unauthenticated remote code execution flaw in the same server, and ZDI-26-573 in August 2026 was a pre-authentication memory leak rated 9.3. This batch landed the same week researcher Hyunwoo Kim disclosed the Infinity Core set of six Linux kernel privilege-escalation bugs.

No exploitation of the new KSMBD flaws has been reported. Still unknown: when the SMB Direct fix reaches mainline, when a fix for ZDI-CAN-33774 appears, and whether ZDI will route future AI-found kernel bugs the same way.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!