KSMBD flaws lack fixes in the mainline Linux kernel
KSMBD flaws rated 9.0 could expose Linux file servers to remote code execution (RCE), meaning an attacker may be able to make the server run malicious instructions over a network. Trend Micro's Zero Day Initiative (ZDI) publicly reported the two vulnerabilities, identified as ZDI-CAN-33774 and ZDI-CAN-33549. Neither had a named fix in the mainline Linux kernel or linux-next integration tree as of the Thursday covered by the reporting.
KSMBD is the Linux kernel's built-in server for Server Message Block (SMB), a protocol commonly used to share files across a network. ZDI-CAN-33774 is the more broadly exposed of the two flaws because it can be triggered before network authentication. According to ZDI's report, any server running KSMBD on port 445 may be affected, without an attacker first needing valid login details.
ZDI-CAN-33774 concerns a race condition, which occurs when operations happen in an unexpected order because their timing overlaps. KSMBD assigns a table that tells worker processes how to handle incoming protocol messages. A client can place several short SMB1 packets and then an SMB2 packet into the same Transmission Control Protocol (TCP) write. Workers may consequently process the shorter SMB1 data with an SMB2 handler, causing data to be read beyond the end of the available buffer. ZDI also described a route to writing beyond the buffer once an attacker has access to a share.
ZDI-CAN-33549 affects the SMB Direct transport and has more specific prerequisites. SMB Direct uses Remote Direct Memory Access (RDMA), a method that transfers data directly between memory areas with limited processor involvement. Exploitation requires an RDMA-capable network interface, either hardware or the rxe software driver, a writable KSMBD share and a client that negotiates SMB Direct.
The underlying problem in ZDI-CAN-33549 is an integer underflow, where a size calculation drops below its valid minimum and wraps to an unintended value. A client can provide RDMA buffer descriptors whose first entry is longer than the declared payload. That makes KSMBD's size counter wrap, after which a later memory copy can extend beyond the allocated buffer. ZDI classified the resulting condition as remote code execution and assigned it a Common Vulnerability Scoring System (CVSS) score of 9.0.
At the reported status point, there was no named correction for either KSMBD issue in the mainline kernel or linux-next, the integration tree used to prepare changes for mainline. Linux news site Phoronix reported that an SMB Direct maintainer had submitted a ZDI-CAN-33549 fix for the next kernel development cycle, although that detail had not been confirmed elsewhere. Even after a correction enters mainline, changes typically require additional weeks to reach stable kernel branches and Linux distribution kernels.
Neither vulnerability had received a Common Vulnerabilities and Exposures (CVE) identifier. The kernel project assigns CVEs only after a correction is available in the stable tree. Administrators can check whether KSMBD is running with systemctl status ksmbd or whether its kernel module is loaded with lsmod | grep ksmbd. Red Hat's support documentation says Red Hat Enterprise Linux does not include KSMBD by default.
The ZDI reports credit TrendAI, Trend Micro's artificial intelligence scanner, with finding the issues. Linux kernel security documentation updated in May 2026 states that flaws discovered by AI tools are already public by definition and should be sent to the relevant subsystem developer mailing lists. ZDI copied public lists as well as the private kernel security address, but did not include patches with the reports.
A stable-kernel maintainer responded to three of the five kernel reports within minutes of one another and objected to receiving public submissions without patches. The reply concerning the VMware virtual graphics driver said there was little maintainers could do with a public report that lacked a correction. Seventeen seconds later, the response to the NVMe target report again asked ZDI to change its submission process.
Three of those five kernel reports do not affect KSMBD. ZDI-CAN-33367 is a local privilege escalation issue rated 7.8 in the networking stack's skb_zerocopy component and requires local access. ZDI-CAN-34068 is a local privilege escalation flaw rated 8.8 in the VMware virtual GPU driver, vmwgfx. ZDI-CAN-34076 is an information disclosure issue rated 8.6 in the NVMe target driver, nvmet. A sixth report, ZDI-CAN-32005, describes a buffer overflow in ConnMan, a network service separate from the Linux kernel.
For organisations reviewing Linux file-sharing exposure, AEU-I provides security-first IT, infrastructure and consulting. Until kernel and distribution fixes become available, administrators should establish whether KSMBD is active, restrict access to port 445, review writable shares and determine whether SMB Direct and RDMA are actually required.