Overview
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws. Trend Micro's Zero Day Initiative (ZDI) rated both CVSS 9.0. As of October 22, 2026, neither has a named fix in the mainline kernel or linux-next, and no CVE IDs have been assigned yet. The kernel project typically assigns them once a stable-tree fix exists.
The Flaws
| ZDI ID | Issue | Conditions |
|---|---|---|
| ZDI-CAN-33549 | Integer underflow in the SMB Direct path leading to a memory overrun | SMB Direct transport, an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share, and a client negotiating SMB Direct |
| ZDI-CAN-33774 | Race in handler table assignment leading to out-of-bounds reads, and writes with share access | Can be triggered before any network authentication on any KSMBD server reachable on port 445 |
The reports credit TrendAI, Trend Micro's AI scanner, as the finder. Affected kernel versions were not listed.
A Disclosure Dispute
The reports were copied to public mailing lists alongside the private kernel security address, without patches. Stable-kernel maintainer Greg Kroah-Hartman replied to three of the five kernel reports in the same batch, objecting to the public routing and the missing patches. The kernel's security documentation was updated in May 2026 to say that AI-found bugs should be treated as already public and sent to subsystem developer lists.
SMB Direct maintainer Stefan Metzmacher reportedly submitted a fix for ZDI-CAN-33549 targeting the next development cycle. That is unconfirmed. Fixes usually take weeks to reach stable branches and distribution kernels.
Who Is Exposed
KSMBD is not the same as Samba. Red Hat Enterprise Linux does not include it by default. Exposure is limited to systems where the ksmbd module is loaded and port 445 is reachable.
Recommended Actions
- Check for KSMBD: run
systemctl status ksmbdorlsmod | grep ksmbdon Linux file servers and appliances. - Disable it if unused: unload the module and stop the service.
- Restrict port 445 to trusted networks with host or network firewall rules until patches ship.
- Disable SMB Direct and RDMA exposure where it is not required.
- Track kernel and distribution advisories for the eventual CVE IDs and fixed builds.