freenode.net

Critical RCE Flaws Discovered in Linux KSMBD with CVSS 9.0 Ratings

First seen 22 Oct 2026, 20:43 UTC • •66.0

Article Content

1 / 6

Browse articles

ThreatCluster •October 22, 2026 at 22:13 UTC

•Two critical RCE vulnerabilities in KSMBD rated CVSS 9.0 disclosed.
•ZDI-CAN-33774 allows exploitation without authentication; ZDI-CAN-33549 requires specific conditions.
•No fixes are currently available, and both vulnerabilities lack CVE identifiers.

Two remote code execution vulnerabilities in the Linux kernel's KSMBD, rated 9.0 by Trend Micro's Zero Day Initiative, were disclosed this week. The first flaw, ZDI-CAN-33774, allows exploitation without network authentication, affecting any server running KSMBD on port 445. The second flaw, ZDI-CAN-33549, requires an RDMA-capable interface and a writable KSMBD. Both vulnerabilities currently lack fixes in the mainline kernel and do not yet have CVE identifiers. The flaws were reported to public mailing lists, and while a patch for ZDI-CAN-33549 has been submitted, it has not been confirmed. Administrators can check for KSMBD activity using specific system commands. The disclosure has prompted critical responses from kernel maintainers regarding the reporting process.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-22

Vulnerabilities disclosed

Trend Micro's Zero Day Initiative reported two critical RCE flaws in KSMBD with CVSS scores of 9.0.

Finance.Biggo

2026-10-22

Patch submitted

A patch for ZDI-CAN-33549 was submitted by the SMB Direct maintainer, but confirmation is pending.

Thehackernews

Threat Graph

14 entities, 23 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Information Disclosure
Local Privilege Escalation
Remote Code Execution
Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Weakness (4)

CWE-119 - Improper Restriction Of Operations Within Memory Buffer
CWE-120 - Classic Buffer Overflow
CWE-200 - Exposure of Sensitive Information
CWE-269 - Improper Privilege Management

Affected Platform (3)

ConnMan
Linux
NVMe

Tool (1)

VMware

Vulnerability (1)

Buffer overflow

Relationships

VMware exploits Buffer overflow
Buffer overflow targets ConnMan
Buffer overflow targets Linux
Buffer overflow targets NVMe
Information Disclosure targets ConnMan
Information Disclosure targets Linux
Information Disclosure targets NVMe
Local Privilege Escalation targets ConnMan
Local Privilege Escalation targets Linux
Local Privilege Escalation targets NVMe
Remote Code Execution targets ConnMan
Remote Code Execution targets Linux
Remote Code Execution targets NVMe
Zero-day Exploit targets ConnMan
Zero-day Exploit targets Linux
Zero-day Exploit targets NVMe
T1068 - Exploitation for Privilege Escalation targets ConnMan
T1068 - Exploitation for Privilege Escalation targets Linux
T1068 - Exploitation for Privilege Escalation targets NVMe
Buffer overflow related to CWE-119 - Improper Restriction Of Operations Within Memory Buffer
Buffer overflow related to CWE-120 - Classic Buffer Overflow
Buffer overflow related to CWE-200 - Exposure of Sensitive Information
Buffer overflow related to CWE-269 - Improper Privilege Management