Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.
One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network interface.
ZDI-CAN-33549 is an integer underflow in KSMBD's SMB Direct path. A client can supply RDMA buffer descriptors in which the first is longer than the declared payload, causing the server's size counter to wrap and allowing a subsequent memory copy to overrun the end of an allocated buffer.
It requires three things: an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share, and a client negotiating SMB Direct.
ZDI-CAN-33774 requires no authentication, exposing any server running KSMBD on port 445. The flaw is a race in how KSMBD assigns its handler table: a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write causes workers to handle SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. A path to writing past the buffer also exists once an attacker has access to a share.
As of Thursday, neither flaw has a named fix in the mainline kernel or in linux-next, the integration tree that feeds it. Linux news site Phoronix said SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 targeting the next kernel development cycle, but this has not been confirmed elsewhere.
Fixes to mainline typically take weeks to reach stable branches and distribution kernels after that. Neither flaw has a CVE identifier, since the kernel project assigns those only after a stable-tree fix is available.
Running systemctl status ksmbd or lsmod | grep ksmbd confirms whether the module is active. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation.
The ZDI reports credit TrendAI, Trend Micro's AI scanner, as the finder. The Linux kernel's security documentation, updated in May 2026 following guidance from Linus Torvalds, states that bugs found by AI tools are, by definition, already public and should be sent to subsystem developer lists.
ZDI's routing appeared to follow that logic, copying public mailing lists alongside the private kernel security address without attaching patches to any of the reports.
Stable-kernel maintainer Greg Kroah-Hartman replied to three of the five kernel reports within minutes of each other. To the report on the VMware GPU driver, he wrote: "For some reason you sent this to public lists, and did not include a patch, so there's not much we can do with this." On the NVMe driver report, seventeen seconds later: "Again, no patch, and sent to a public list? Please fix your submission process."
| ZDI ID | Subsystem | Flaw class | CVSS | Affects KSMBD? |
|---|---|---|---|---|
| ZDI-CAN-33549 | KSMBD SMB Direct | Remote code execution | 9.0 | Yes (SMB Direct and RDMA required) |
| ZDI-CAN-33774 | KSMBD protocol dispatch | Remote code execution | 9.0 | Yes (any KSMBD install) |
| ZDI-CAN-33367 | Networking (skb_zerocopy) | Local privilege escalation | 7.8 | No |
| ZDI-CAN-34068 | VMware GPU driver (vmwgfx) | Local privilege escalation | 8.8 | No |
| ZDI-CAN-34076 | NVMe target driver (nvmet) | Information disclosure | 8.6 | No |
Three of the five kernel reports are not related to SMB. ZDI-CAN-33367, discovered by researcher p1r0x, is a local privilege escalation in the kernel's networking stack that requires local access. ZDI-CAN-34068 is a local privilege escalation in the VMware virtual GPU driver, ZDI-CAN-34076 is an information disclosure in the NVMe target driver, and neither affects KSMBD servers.
A sixth ZDI report, ZDI-CAN-32005, is a buffer overflow in ConnMan, a network daemon separate from the Linux kernel.
