Two critical remote code execution flaws discovered in Linux KSMBD

Linux has recently disclosed two high-severity remote code execution vulnerabilities, tracked as ZDI-CAN-33774 and ZDI-CAN-33549 in the Linux kernel’s KSMBD-related components.

With this blog, we will break down what the critical Linux KSMBD vulnerabilities are , the threat they pose, and what organizations should do to defend against them.

the vulnerabilities

ZDI-CAN-33549/9.0 (Critical)

Trend Micro Zero Day Initiative

Race Condition and Integer Underflow

Linux Kernel Organization/

KSMBD (in-kernel SMB server) and SMB Direct (RDMA)

KSMBD, Linux Kernel’s built-in SMB server.

The two flaws affect different parts of how a system handles file sharing over a network.

ZDI-CAN-33774 – No login required

This flaw arises due to a timing problem in KSMBD, a service that lets Linux-based computers files over a network. An attacker can exploit this problem without logging in, given that the vulnerable service is reachable over the network.

ZDI-CAN-33549 – Specific conditions required

This flaw affects the SMB Direct method of transferring data between computers using Remote Direct Memory Access. For an attacker to exploit this flaw, the system must support RDMA data transfer technology, and the attacker should have write access to a shared folder.

Please note: Trend Micro’s Zero Day initiative classifies both vulnerabilities as remote code execution vulnerabilities. However, publicly reported proof-of-concept has demonstrated kernel memory disclosure and crashes rather than confirmed remote code execution.

The first vulnerability can be exploited if the service is reachable, while the second needs additional requirements, which limits the systems that could be targeted.

What can attackers do with the vulnerabilities?

Authentication required?

ZDI-CAN-33774 – KSMBD Protocol Dispatch Race Condition

Systems running KSMBD with the SMB service reachable over the network.

Kernel memory disclosure

Potentially more severe consequences if the reported code-execution vulnerability is successfully exploited.

ZDI-CAN-33549 – SMB Direct Integer Underflow

Access to a writable .

SMB Direct negotiation and an RDMA-capable network interface.

Kernel memory corruption

Potential remote code execution.

An attacker can exploit the vulnerabilities to:

Potentially execute code on affected Linux systems remotely.

Disclose sensitive kernel memory/corrupt kernel memory.

Trigger system crashes or cause SMB file-sharing services to become unavailable.

Cause a compromise of Linux systems running KSMBD.

Targeted exposed KSMBD services through untrusted networks.

The actual risk depends on whether KSMBD is installed, enabled, reachable, and configured to use the affected functionality.

Official mitigation guidance

At the time of the referenced reports, neither vulnerability had a confirmed fix merged into the mainline Linux kernel.

ZDI-CAN-33774: A fix was reported in the KSMBD maintainer’s tree but had not yet reached mainline.

ZDI-CAN-33549: A fix had been submitted for a future kernel development cycle but was not yet confirmed as merged.

Until applicable fixes are available through the relevant Linux distribution, organizations should:

Check whether KSMBD is running.

Disable KSMBD if it is not required.

Restrict SMB access to trusted networks and prevent exposure to untrusted networks.

For environments using SMB Direct, review whether RDMA functionality can be temporarily restricted without disrupting required operations.

Monitor official kernel and distribution security advisories for validated fixes.

These are temporary risk-reduction measures and do not replace installing the applicable security updates when they become available.

SharkStriker’s recommendations

Identify Linux servers with KSMBD installed, loaded, or running.

Disable KSMBD on systems that do not require it.

Restrict SMB access to authorized hosts and trusted network segments.

Review RDMA and SMB Direct configurations for potential exposure to ZDI-CAN-33549.

Monitor Linux kernel logs for unexpected errors and crashes involving KSMBD.

Track official kernel and distribution advisories and apply relevant fixes as soon as they become available.

Include affected systems in vulnerability management and threat-hunting activities.

SharkStriker’s actions

Threat intelligence reviewed using ZDI-related reporting and supporting technical analysis.

Both vulnerability identifiers and their distinct prerequisites assessed.

Detection opportunities identified for KSMBD service exposure and suspicious SMB activity.

Threat hunting recommended for systems running the affected in-kernel SMB server.