Two critical KSMBD flaws disclosed before Linux kernel fixes
Two remote code execution vulnerabilities rated CVSS 9.0 have been disclosed in KSMBD, Linux's in-kernel SMB server, before named fixes reached the mainline kernel or linux-next integration tree. Trend Micro's Zero Day Initiative assigned the issues the identifiers ZDI-CAN-33774 and ZDI-CAN-33549.
ZDI-CAN-33774 affects any server running KSMBD and listening on port 445 because it can be triggered before network authentication. ZDI-CAN-33549 affects the SMB Direct path and requires an RDMA-capable network interface, a writable KSMBD share and a client that negotiates SMB Direct.
Unauthenticated protocol-dispatch issue
ZDI-CAN-33774 is a race in the way KSMBD assigns its handler table. An attacker can send a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write, causing workers to process SMB1 data with an SMB2 handler. That mismatch reads beyond the end of the shorter buffer.
The report also describes a path to writing beyond the buffer once an attacker has access to a share. This makes externally reachable KSMBD deployments particularly important to identify, because the initial protocol path does not require credentials.
SMB Direct underflow requires RDMA conditions
ZDI-CAN-33549 is an integer underflow in KSMBD's SMB Direct implementation. A client can supply RDMA buffer descriptors in which the first descriptor is longer than the declared payload. The server's size counter can then wrap, allowing a later memory copy to run beyond an allocated buffer.
The SMB Direct issue is more conditional than the protocol-dispatch flaw: it needs RDMA hardware or the rxe software driver, a writable share and an SMB Direct-negotiating client. Phoronix reported that SMB Direct maintainer Stefan Metzmacher had submitted a fix for the next kernel development cycle, although that submission was not independently confirmed in the reports.
Public reporting and patch status
Neither KSMBD flaw had a CVE identifier at the time of publication. The kernel project assigns CVEs only after a stable-tree fix is available. The reports were credited to TrendAI, Trend Micro's AI scanner, and were sent to public subsystem mailing lists alongside the private kernel security address without patches attached.
The disclosure arrives amid continued scrutiny of Linux attack paths, including a container escape leading to host root access showing how a container escape can lead to root access on the host. In this case, stable-kernel maintainer Greg Kroah-Hartman objected in replies to other ZDI kernel reports that public submissions without patches left maintainers with little to act on.
What administrators should check
Administrators can establish whether the module is active with systemctl status ksmbd or lsmod | grep ksmbd. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat support documentation.
Teams operating KSMBD should review internet exposure on port 445, determine whether SMB Direct and RDMA are enabled, and follow kernel and distribution advisories for fixes. The practical priority is to identify active KSMBD services and reduce unnecessary exposure while patches progress through the kernel release process.