Linux servers running KSMBD, the in-kernel SMB server, are exposed to two publicly reported remote code execution vulnerabilities rated 9.0 by Trend Micro’s Zero Day initiative, with no fixes yet in the main kernel.
One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires SMB Direct transport and an RDMA-compatible network interface.
ZDI-CAN-33549 is an integer underflow in the SMB Direct path of KSMBD. A client may provide RDMA buffer descriptors in which the first is longer than the declared payload, causing the server’s size counter to wrap and allowing a subsequent memory copy to exceed the end of an allocated buffer.
This requires three things: an RDMA-compliant interface (hardware or rxe software driver), a writable KSMBD share, and an SMB Direct trading client.
ZDI-CAN-33774 requires no authentication, exposing any server running KSMBD on port 445. The flaw is a race in how KSMBD allocates its handler table: a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write forces workers to handle SMB1 data with an SMB2 handler, reading past the end of the shortest buffer. A path to write beyond the buffer also exists once an attacker gains access to a share.
As of Thursday, neither flaw has a named patch in the main kernel or in Linux-next, the integration tree that powers it. Linux news site Phoronix said that SMB Direct maintainer Stefan Metzmacher had submitted a patch for ZDI-CAN-33549 targeting the next kernel development cycle, but this has not been confirmed elsewhere.
Patches to the mainnet typically take weeks to reach stable branches and distribution cores thereafter. Neither flaw has a CVE ID, since the kernel project only assigns them after a stable tree patch is available.
Running systemctl status ksmbd or lsmod | grep ksmbd confirms if the module is active. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat support documentation.
ZDI reports credit TrendAI, Trend Micro’s AI scanner, as the researcher. The Linux kernel security documentation, updated in May 2026 at the advice of Linus Torvalds, states that bugs detected by AI tools are, by definition, already public and should be sent to subsystem developer lists.
ZDI’s routing seemed to follow this logic, copying the public mailing lists with the kernel’s private security address without attaching patches to any of the reports.
Greg Kroah-Hartman, stable core lead, responded to three of five core reports within minutes of each other. Regarding the VMware GPU driver report, he wrote: “For some reason you sent this to public lists and didn’t include a fix, so there’s not much we can do with this.” » On the NVMe driver report, seventeen seconds later: “Again, not patched and sent to a public list? Please fix your submission process. »
| ID ZDI | Subsystem | Fault class | CVSS | Affects KSMBD? |
|---|---|---|---|---|
ZDI-CAN-33549 | KSMBD PME Direct | Remote Code Execution | 9.0 | Yes (SMB Direct and RDMA required) |
ZDI-CAN-33774 | Sending KSMBD protocol | Remote Code Execution | 9.0 | Yes (any KSMBD installation) |
ZDI-CAN-33367 | Networking (skb_zerocopy) | Local privilege escalation | 7.8 | No |
| ZDI-CAN-34068 | VMware GPU driver (vmwgfx) | Local privilege escalation | 8.8 | No |
| ZDI-CAN-34076 | NVMe target driver (nvmet) | Disclosure of information | 8.6 | No |
Three of the five kernel reports are not related to SMB. ZDI-CAN-33367, discovered by a researcher p1r0xis a local privilege escalation in the kernel networking stack that requires local access. ZDI-CAN-34068 is a local privilege escalation in the VMware virtual GPU driver, ZDI-CAN-34076 is an information disclosure in the NVMe target driver, and neither affects KSMBD servers.
A sixth ZDI report, ZDI-CAN-32005, concerns a buffer overflow in ConnMan, a network daemon separate from the Linux kernel.
Gn tech
