<![CDATA[🔴 Critical: Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes]]>Linux servers running KSMBD, the SMB server built directly into the kernel, are currently exposed to two remote code execution flaws that Trend Micro's Zero Day Initiative has rated 9.0 on the CVSS scale. The details were disclosed on public mailing lists, and as of now no fix has landed in the mainline kernel.

The two issues are tracked as ZDI-CAN-33774 and ZDI-CAN-33549. The first is the more dangerous of the pair, since it can be triggered before any network authentication takes place. The second requires the SMB Direct transport along with an RDMA-capable network to be exploited.

Key points for defenders:

  • Both flaws affect KSMBD, so any Linux server with the in-kernel SMB server enabled should be reviewed.
  • ZDI-CAN-33774 is pre-authentication, meaning exposure does not depend on valid credentials.
  • ZDI-CAN-33549 is narrower in scope, requiring SMB Direct and RDMA-capable networking.
  • No mainline kernel fix is available at the time of disclosure.

Given that the flaws were reported publicly before patches were merged, administrators running KSMBD should treat this as urgent: consider disabling or restricting the service where it isn't strictly needed, and monitor kernel updates closely for fixes.

Source: info@thehackernews.com (The Hacker News)

Is your organization running KSMBD in production, and if so, are you disabling it or waiting for kernel patches?

]]>https://xploitlk.com/topic/781/critical-two-cvss-9.0-linux-ksmbd-rce-flaws-disclosed-on-public-mailing-lists-before-kernel-fixesRSS for NodeTue, 27 Oct 2026 07:29:35 GMTSun, 25 Oct 2026 00:30:17 GMT60