Ethical Hacking News
Two critical remote code execution flaws have been publicly disclosed in Linux's KSMBD server, rated 9.0 by Trend Micro's Zero Day Initiative. The flaws, ZDI-CAN-33774 and ZDI-CAN-33549, can be triggered remotely without network authentication and require specific conditions to be exploited. The Linux community is working to address these flaws and apply kernel fixes. Users are advised to keep their Linux kernel up-to-date and use secure protocols to prevent these types of attacks.
The Linux kernel's SMB server, KSMBD, has been found to be vulnerable to two remote code execution (RCE) flaws. The first RCE flaw, ZDI-CAN-33774, can be triggered before any network authentication, making it a serious security concern. The second RCE flaw, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network interface. Both flaws have been publicly disclosed on public mailing lists, but it is unclear when or if kernel fixes will be applied. The Linux community is working to address these flaws and apply kernel fixes. Red Hat Enterprise Linux does not include KSMBD by default, and users should run up-to-date software, use secure protocols, and keep the Linux kernel up-to-date to prevent attacks.
The Linux kernel's built-in SMB server, KSMBD, has been found to be vulnerable to two remote code execution (RCE) flaws, rated 9.0 by Trend Micro's Zero Day Initiative. These flaws were publicly disclosed on public mailing lists before any kernel fixes were applied, highlighting the need for increased vigilance in the Linux community.
The first RCE flaw, ZDI-CAN-33774, can be triggered before any network authentication, making it a serious security concern. This flaw is caused by a race in the way KSMBD assigns its handler table, allowing an attacker to read past the end of a buffer and potentially execute arbitrary code.
The second RCE flaw, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network interface. This flaw is caused by an integer underflow in KSMBD's SMB Direct path, allowing a client to supply RDMA buffer descriptors that are longer than the declared payload. This can cause the server's size counter to wrap, leading to a subsequent memory copy that overruns the end of an allocated buffer.
Both flaws have been publicly disclosed on public mailing lists, and it is unclear when or if kernel fixes will be applied. Trend Micro's Zero Day Initiative has reported these flaws, and TrendAI, their AI scanner, has been credited with finding the ZDI-CAN-33549 flaw.
The Linux kernel's security documentation, updated in May 2026, states that bugs found by AI tools are, by definition, already public and should be sent to subsystem developer lists. However, the ZDI report appears to have followed this logic, copying public mailing lists alongside the private kernel security address without attaching patches to any of the reports.
Stable-kernel maintainer Greg Kroah-Hartman replied to three of the five kernel reports within minutes of each other, expressing his disappointment at the lack of patches and the fact that the reports were sent to public lists.
The Linux community is currently working to address these flaws and apply kernel fixes. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation. Running systemctl status ksmbd or lsmod | grep ksmbd confirms whether the module is active.
In related news, researchers have demonstrated open-source exploits for several Linux kernel vulnerabilities, including a 37-year-old shared-memory bug and a pre-authenticated AnyDesk Linux flaw that gives root access.
It is essential for Linux users to be aware of these vulnerabilities and take steps to protect themselves. Running up-to-date software, using secure protocols, and keeping the Linux kernel up-to-date can help prevent these types of attacks.
In conclusion, the exposure of these two critical RCE flaws in Linux's KSMBD server highlights the need for increased vigilance in the Linux community. It is crucial for users and developers to be aware of these vulnerabilities and take steps to protect themselves.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposure-of-Two-Critical-Remote-Code-Execution-Flaws-in-Linuxs-KSMBD-Server-ehn.shtml
https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html
https://www.sepe.gr/en/it-technology/cybersecurity/22789709/two-cvss-9-0-linux-ksmbd-rce-flaws-disclosed-on-public-mailing-lists-before-kernel-fixes/
Published: Thu Oct 22 14:02:38 2026 by llama3.2 3B Q4_K_M
