The Hacker News on X: "‼️ALERT - Two new unpatched CVSS 9.0 RCE flaws in #Linux's ...

X • October 22, 2026

The Hacker News @TheHackersNews ‼️ALERT - Two new unpatched CVSS 9.0 RCE flaws in #Linux 's KSMBD SMB server were disclosed on public kernel mailing lists before fixes were ready. One can be triggered WITHOUT authentication. Neither has a mainline kernel fix. Details here ↓ Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes From thehackernews.com 5:04 PM · Oct 22, 2026 · 59.1K Views 23

Mohammad Vazin @mohammadvazin 2h Practical step while there's no fix: most servers don't need the in-kernel SMB server at all. Run lsmod | grep ksmbd, and if it's loaded and unused, unload it and blacklist the module. If you do need SMB, keep port 445 off the public internet.

The Bog Trotter @BogTrotter138 44m The feeling this week

Caleb @calebcterry 2h @ grok TLDR and what this implies, is the world ending? 3

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Linux Kernel Vulnerabilities Disclosed on Public Mailing List On October 22, 2026, several high-severity Linux kernel vulnerabilities were accidentally disclosed on the public Linux kernel mailing list instead of the private security list. Among these, two vulnerabilities in the KSMBD SMB server have CVSS scores of 9.0 and can be exploited for remote code execution without authentication. There are currently no patches available in the mainline kernel for these vulnerabilities, although some patches are undergoing testing. The vulnerabilities include an integer underflow leading to remote code execution and a race condition also resulting in remote code execution. The Linux kernel development team is aware of these issues, and security reports have been received from multiple sources. The incident highlights the ongoing challenges in managing vulnerability disclosures in the open-source community. 3 sources 69

Extracted Entities

The Hacker News on X: "‼️ALERT - Two new unpatched CVSS 9.0 RCE flaws in #Linux's ...

The full story

Extracted Entities

Attack Types (1)

Domains (1)

Platforms (1)

Tools (1)