Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

KSMBD is the Linux kernel's built-in implementation of an SMB server. SMB is the protocol used for network file sharing and related services. A Linux server running KSMBD can therefore offer shares that SMB clients access over the network, commonly through port 445. Because KSMBD is part of the kernel, flaws in it can affect a highly privileged component.

The article describes two remote code execution flaws in KSMBD. One affects the SMB Direct path, while the other involves how KSMBD chooses handlers for SMB1 and SMB2 data. The second issue can be reached by sending specially arranged SMB packets, including a burst of short SMB1 packets followed by an SMB2 packet in one TCP write.

KSMBD is not enabled on every Linux server. Administrators can check with systemctl status ksmbd or lsmod | grep ksmbd. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation.

A CVSS score of 9.0 is considered critical under the Common Vulnerability Scoring System. It signals potentially severe impact and easy or meaningful remote exploitation, though the score does not mean every Linux server is exposed. The article reports that Trend Micro's Zero Day Initiative rated both KSMBD flaws 9.0.

The broadest exposure comes from ZDI-CAN-33774. It requires no authentication and affects any server running KSMBD on port 445 that is reachable by an attacker. ZDI-CAN-33549 is narrower. It needs an RDMA-capable interface, either hardware or the rxe software driver, a writable KSMBD share, and a client that negotiates SMB Direct.

The article gives no count of affected servers worldwide. Exposure therefore depends on whether KSMBD is active, whether port 445 is reachable, and whether the extra SMB Direct conditions exist. Red Hat Enterprise Linux does not include KSMBD by default.

Both bugs are described as remote code execution flaws, meaning a successful attacker could potentially run code on the affected server remotely. The article does not describe a completed exploit or specify what commands an attacker would run. It does show that the flaws corrupt memory, which is why the consequences can be severe.

ZDI-CAN-33774 is especially concerning because it requires no authentication. An attacker sends a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write. A race can make workers use an SMB2 handler on shorter SMB1 data, causing a read past the buffer. Once an attacker has share access, a path to writing past the buffer also exists.

ZDI-CAN-33549 can overrun an allocated buffer through a different route. Its integer underflow corrupts a size calculation in the SMB Direct path, allowing a later memory copy to run beyond the buffer's end. The article does not claim exploitation in the wild.

SMB Direct is an SMB transport that uses RDMA networking. That gives the server a special path for handling RDMA buffer descriptors. ZDI-CAN-33549 therefore cannot be reached through every ordinary SMB connection. The client must negotiate SMB Direct, and the server needs an RDMA-capable interface, including hardware or the rxe software driver.

The attack supplies RDMA descriptors whose first buffer is longer than the declared payload. KSMBD's size counter then wraps through an integer underflow. A later memory copy trusts the bad value and can run beyond an allocated buffer. The flaw also requires a writable KSMBD share.

ZDI-CAN-33774 is different because it targets normal SMB packet processing. A burst of short SMB1 packets followed by an SMB2 packet in one TCP write races KSMBD's handler-table assignment. Workers can process SMB1 data with an SMB2 handler, reading past the shorter buffer. No RDMA or SMB Direct negotiation is required.

Public disclosure before a fix can increase risk because defenders may know a vulnerability exists while attackers can study the same technical details. The article says ZDI copied public mailing lists alongside the private kernel security address and did not attach patches. It also notes that AI-found bugs are treated as already public under updated kernel security guidance.

As of Thursday, neither KSMBD flaw had a named fix in the mainline kernel or linux-next. Phoronix reported that SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 for the next development cycle, but the article says this was not confirmed elsewhere. The absence of a named patch leaves no mainline fix to backport.

Even after a mainline change appears, the article says fixes typically take weeks to reach stable branches and distribution kernels. Neither flaw has a CVE identifier because the kernel project assigns those only after a stable-tree fix becomes available.

Administrators can check whether KSMBD is active with systemctl status ksmbd or lsmod | grep ksmbd. This quickly distinguishes servers that may be exposed from systems that do not load the module. The article also notes that Red Hat Enterprise Linux does not include KSMBD by default, which reduces exposure on installations following that default.

While waiting, administrators should disable or unload KSMBD where it is not needed. They should restrict inbound access to port 445 with firewalls and network segmentation, especially from untrusted networks. Access to writable shares should be limited to necessary clients. These are practical defensive steps, not fixes for the underlying bugs.

For systems that require KSMBD, administrators can reduce the narrower flaw's prerequisites by disabling SMB Direct or RDMA where operationally possible and removing unnecessary writable shares. They should monitor kernel and distribution advisories, then apply a vendor fix when available. The article says stable fixes may take weeks after mainline.

A kernel module is code that can be loaded into the operating system kernel, extending its capabilities without rebuilding the whole kernel. A memory buffer is a reserved area used to hold data. Software must track each buffer's size accurately. A race condition occurs when concurrent workers access shared state in an unsafe order, producing a result that depends on timing.

An integer underflow happens when a calculation drops below the smallest value the integer type can represent. The value wraps to a very large number or otherwise becomes incorrect. In ZDI-CAN-33549, an oversized first RDMA descriptor makes KSMBD's size counter underflow. In ZDI-CAN-33774, a handler-assignment race makes workers treat shorter SMB1 data as SMB2 data.

Both mistakes can defeat buffer bounds checks. Code may read or copy beyond allocated memory, corrupting data or control information. If an attacker can reliably shape that corruption through network packets, the result can become remote code execution. The article reports these two KSMBD bugs as RCE flaws.