Two CVSS 9.0 RCEs Hit KSMBD, No Kernel Patch Ready

Two Trend Micro ZDI-tracked flaws in Linux’s KSMBD module leave any server exposing the kernel SMB stack at remote code execution range, and as of October 22 neither vulnerability has a CVE identifier, a fix in mainline, or a patch in linux-next.

KSMBD is Linux’s built-in SMB server, merged into the kernel starting with version 5.15. It is not universally deployed: Red Hat Enterprise Linux does not ship it by default, and most distributions do not enable it without explicit configuration. Where it does run, it handles network file sharing on port 445. The attack surface is narrower than it would be for a universally default service, but servers that have enabled it are fully exposed to both flaws without a patch to apply.

The two bugs were identified by Trend Micro’s TrendAI scanner and submitted through the ZDI program under tracking identifiers ZDI-CAN-33549 and ZDI-CAN-33774.

ZDI-CAN-33549 involves an integer underflow in KSMBD’s SMB Direct implementation. A client supplying RDMA buffer descriptors where the first descriptor exceeds the declared payload length causes the server’s size counter to wrap, opening a buffer overrun during subsequent memory operations. This vector requires an RDMA-capable interface, a writable KSMBD share, and SMB Direct negotiation, which limits exposure to systems with that hardware combination.

ZDI-CAN-33774 is a race condition in the handler table assignment. Sending a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write causes workers to mishandle protocol data and read or write past buffer boundaries. That flaw requires no authentication; it affects any KSMBD deployment reachable on port 445.

ZDI scored both at 9.0. Neither has a CVE identifier: ZDI policy holds assignment until a stable-tree patch is available. SMB Direct maintainer Stefan Metzmacher has submitted a fix, but it targets the next development cycle rather than an out-of-band stable release.

The disclosure path is the more instructive part. Both advisories reached public mailing lists before any kernel patch existed, putting two CVSS 9.0 flaws with public technical descriptions in front of potential attackers before administrators have anything to apply. This is a recurring tension between ZDI’s timed disclosure model and the kernel community’s preference for coordinated disclosure once a fix is in the stable tree. Neither approach is wrong on its own terms, and neither helps the sysadmin who is running KSMBD and looking at a bulletin with no patch date. KSMBD has seen this before: CVE-2026-72044, a stack overflow in multichannel session binding, went through a quieter patch cycle in August, but that one at least had a CVE and a stable fix in hand when it was disclosed. These two do not.

For administrators running KSMBD: restrict port 445 to trusted network segments, disable KSMBD if it is not required, and watch the stable tree for patch commits. Both ZDI advisories will be updated with CVE identifiers when stable patches land. There is no confirmed exploitation in the wild as of the October 22 reporting from The Hacker News, and ZDI has not published proof-of-concept code, but the technical details are now public.

The broader pattern of kernel-adjacent vulnerabilities turning up through automated scanning is worth following. AI tooling found a separate Linux vhost flaw last week that allowed root and VM escape, and PwnEscape the week before surfaced a kernel flaw letting VMs read host memory. The rate of AI-assisted discovery is changing the cadence, and the coordination infrastructure that worked reasonably well for human-paced research is under pressure.