Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Two KSMBD vulnerability reports, each rated CVSS 9.0 by Trend Micro’s Zero Day Initiative, were posted to the public Linux kernel mailing list on October 21, 2026. At the latest cited updates, neither issue had a verified fix in a released kernel. That does not mean every Linux server is vulnerable, and the public proof-of-concept material demonstrated kernel-memory disclosure and crashes—not confirmed remote code execution. Risk depends on whether KSMBD is built and running, how shares are configured, and, for one flaw, whether SMB Direct over RDMA is enabled.
What happened with the KSMBD reports?
The two reports concern different parts of KSMBD, the Linux kernel’s in-kernel SMB server. ZDI-CAN-33549 was posted to the public Linux kernel mailing list at 21:16 UTC on October 21, 2026. ZDI-CAN-33774 followed at 21:36 UTC.
As an Amazon Associate I earn from qualifying purchases.
Public disclosure came before a released-kernel fix had been verified. The KSMBD maintainer identified commit 68f410faedaf in a development branch for the protocol-dispatch issue, while the SMB Direct developer said a Linux 7.5 development branch already addressed the other issue. A development-tree commit is not an installable fix: administrators must wait for, and verify, their distribution’s released kernel update or security advisory.
How do the two vulnerabilities differ?
ZDI-CAN-33774 has the broader reported reach because it does not require special RDMA hardware. ZDI-CAN-33549 is narrower but still severe because it requires SMB Direct, an RDMA-capable interface and a writable KSMBD share.
Popular on Amazon
- 【90 Degree Full Function USB C Adapter】Supports the latest USB4 standard for up to 40Gbps of bandwidth, 8K video support, and up to 240W Fast charging; Support USB PD 3.1 Extended Power Range (EPR) including 140W, 180W and 240W. Your productivity is easily doubled. *Warm Tip: For the best fit, please make sure the USB-C port is fully exposed; thick or bulky cases may affect compatibility.
- 【Reliable Quality】Made from high-quality, scratch-resistant aluminum alloy, delicate metal frame. get excellent wear resistance and heat dissipation. Non-Slip Design for easier insertion and removal.
- 【Small and portable】Ultra thin size, ultra compact design, a petite physique that matches the minimalist design of your modern laptops. Coming with a slim figure that won't block the port next to the one it's plugged into.
- 【Compatibility】Widely work with most usb c, thunderbolt 4/3 devices. Compatibilit for ROG Ally, Steam Deck, Switch, MacBook Pro, Quest 3 VR headset, Surface Book 2, iPhone 18/17/16/15, Samsung Galaxy S23/S22/S21, Note 20/10, Google Pixel, ChromeBook, etc.
- 【Excellence Customer Support】If you experience any issues or cable failure, simply reach out to our dedicated customer service team. We provide a prompt response within 18 hours, providing you with the necessary technical support to resolve any concerns.
| Characteristic | ZDI-CAN-33774 | ZDI-CAN-33549 |
|---|---|---|
| KSMBD area | Protocol dispatch | SMB Direct transport |
| Reported flaw | Race can pair SMB1 data with an SMB2 handler, causing out-of-bounds access | Integer underflow in RDMA descriptor handling can overrun a later copy |
| Access conditions | Reported as reachable without authentication; the incident timeline notes a guest-share condition | Writable share plus SMB Direct negotiation |
| Special hardware | None stated | RDMA-capable interface or the software rxe driver |
| CVSS | 9.0, ZDI rating | 9.0, ZDI rating |
| Released fix at cited update | Not verified | Not verified |
ZDI-CAN-33774: protocol-dispatch race
The report describes a race while KSMBD assigns protocol handlers. A burst of short SMB1 packets followed by an SMB2 packet in one TCP write can cause worker threads to process SMB1 data with an SMB2 handler. Because the structures have different lengths, the handler may read beyond the shorter buffer.
The cited public proof of concept leaked 28 bytes of kernel-heap memory per attempt and could crash the kernel. The report also described a possible out-of-bounds write path, but the published material did not demonstrate code execution. The incident timeline says the race needs a guest share, so administrators should verify how their distribution configures guest access rather than assuming that every KSMBD share meets that condition.
ZDI-CAN-33549: SMB Direct integer underflow
This bug is in KSMBD’s SMB Direct path. A client can supply RDMA buffer descriptors in which the first descriptor is longer than the declared payload. The size counter can wrap around, and a later copy can overrun the allocated destination buffer.
The reported prerequisites are an RDMA-capable interface—physical hardware or the software rxe driver—SMB Direct negotiation, and a writable KSMBD share. A server that does not expose SMB Direct or writable KSMBD data is not meeting those stated conditions, but its operator should still confirm that configuration with the distribution’s advisory.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Are these proven remote-code-execution bugs?
They are severe kernel vulnerabilities with a CVSS score of 9.0, and the reports describe memory-corruption paths that could potentially be developed into code execution. However, the cited public demonstrations established a 28-byte heap leak and crashes for ZDI-CAN-33774; they did not establish public kernel code execution. Calling them “public RCEs” goes beyond the available evidence.
Am I running KSMBD?
Start by checking the kernel configuration and module. On a running system, use:
Recommended Free Tools
grep SMB_SERVER /boot/config-$(uname -r)
modinfo ksmbdA built-in configuration option, an available ksmbd module or a running ksmbd.mountd service indicates that further checks are needed. Check whether the service is active using your distribution’s service manager, inspect the server’s SMB shares, and confirm whether TCP port 445 is reachable from networks that should not access it. Also look for SMB Direct/RDMA support and whether the software rxe driver is enabled.
These checks identify exposure; they do not replace a vendor patch. For distributions other than Red Hat Enterprise Linux, consult the distribution’s security tracker and released-kernel changelog for the exact backport status.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Does this affect Samba?
Not automatically. KSMBD is an SMB server implemented in the Linux kernel, while Samba is a separate userspace SMB server. A machine serving files through Samba is not affected by these KSMBD-specific reports unless KSMBD is also present and configured. Check the active service and kernel module instead of inferring exposure from the fact that SMB is available.
What does Red Hat say about exposure?
Red Hat says its shipping products do not include ksmbd. Its advisory also says default settings disable CONFIG_SMB_SERVER_SMBDIRECT and CONFIG_RDMA_RXE. That substantially limits the SMB Direct scenario on those products, but administrators should still verify the exact product, kernel configuration and any local changes. Other Linux distributions can make different build and configuration choices.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsWhy are there no CVE numbers yet?
The initial lack of CVE identifiers is consistent with the Linux kernel’s stated CVE process, not evidence that the reports are harmless. Kernel policy says automatic assignment occurs after a fix is available and applied to a stable kernel tree; unfixed issues are not automatically assigned CVEs.
Security scanners and advisories may therefore use the ZDI identifiers first. Recheck your distribution’s tracker after a stable fix is published, because a CVE and a backported package may appear at different times.
Also popular on Amazon
- Portable and powerful USB-C HUB: BENFEI USB Type-C HUB, with super-soft and knot-free silicone woven design cable, meets most mobile office needs. Compact, lightweight, stylish, and powerful portable USB C Hub equipped with 1 x HDMI port, 1 x 100W charging, and 3 x USB ports. 18-month warranty, 24-hour response, to ensure you feel at ease when using our product.
- Design centered on comfort and reliability: Thanks to BENFEI's end-to-end in-house cable production capability, in-house PCBA and assembly capability, using the industry's most advanced silicone woven design and process, 20cm cable in length, no knots, super-soft, the HUB is easy to use in all scenarios: laptop, tablet, stand etc. Super-soft, 25000+ life cycles, to meet your daily carrying and office needs.
- 100W Charging: Support up to 90W USB C pass-through charging via Type-C port to keep your laptop powered. 10W is reserved for other interface operations. No data and video function on the Type-C port.
- 4K HDMI Display: The HDMI port supports media display at resolutions up to 4K 30Hz, keeping every incredible moment detailed and ultra vivid. Please note that the C port of the Host device needs to support video output.
- Transfer Files in Seconds: Transfer files and from your laptop at speeds up to 10 Gbps with USB A 3.2 port. Extra 2 USB A 2.0 ports are perfectly for your keyboards and mouse.
What should administrators do before a released fix?
- Confirm whether KSMBD exists. Check the running kernel configuration,
modinfo ksmbd, loaded modules and the KSMBD service. - Reduce unnecessary reachability. Restrict TCP 445 to trusted networks and remove internet exposure. Review guest shares, since the dispatch-race timeline specifies a guest-share condition.
- Review share permissions. Identify writable KSMBD shares and disable or make them read-only where operationally possible.
- Review RDMA and SMB Direct. If you do not need SMB Direct, disable the relevant feature according to your distribution’s documentation. Check both physical RDMA devices and the
rxesoftware driver. - Track the released kernel. Do not install a development-tree commit as though it were a supported package. Apply the vendor’s released kernel update when it is published, reboot as required, and verify the running kernel afterward.
- Preserve evidence. Until patched, monitor kernel logs and unexpected reboots or SMB service failures, and record the KSMBD configuration so changes can be audited.
What does the public disclosure mean for defenders?
Linux kernel security guidance normally calls for an affected-version range, detailed description, reproducer and triggering conditions to be sent to subsystem maintainers and the security team. It generally discourages public posting before coordination unless the issue is already public or trivially discoverable.
In contemporaneous coverage, Greg Kroah-Hartman wrote: “For some reason you sent this to public lists, and did not include a patch, so there’s not much we can do with this.” Publishing technical details before a patch can enlarge the period in which exposed systems face investigation or weaponization, even when no public exploit for code execution exists.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The practical conclusion is narrow but urgent: identify KSMBD, remove unnecessary guest or writable exposure, disable unneeded SMB Direct/RDMA, and follow your distribution’s released advisory. Treat the two CVSS 9.0 ratings as a prioritization signal, not as proof that every Linux host or every Samba deployment is affected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Frequently Asked Questions
Can I safely use a kernel containing the development commit mentioned in coverage?
A commit hash from a maintainer’s development branch is not a supported package and may lack related backports or testing. Use the kernel release and security advisory supplied by your distribution, then verify that the running kernel contains the vendor’s fix.
Also popular on Amazon
- 【Read before You Buy】 Note: This adapter is USB 2.0 version and cannot transmit HDM, VGA, or other video signals. Nevertheless, they are fully capable of charging devices,duplicating files, and can be seamlessly integrated with USB-C earphones, wireless network adapters, and SD card adapters.
- 【Easy to Use and Safe】Thanks to modern manufacturing techniques, we've made these adapters sufficiently compact so that they can remain inserted in your device without noticeable protrusion or inconvenience. This means you don't have to constantly plug and unplug them, reducing the likelihood of wear and misalignment, and making them more convenient to carry around.
- 【Reliable Quality】Engineered for enhanced durability, durable aluminum alloy shell material,get excellent wear resistance and heat dissipation,the male USB C and female USB connectors & the male USB and female USB C connectors are designed to be plugged and unplugged up to 20000 times. Provides data transfer, device charging, memory space expansion, and additional computer peripherals.
- 【Think more for you】Do you need to connect a USB-C-enabled device to an odd device that only has USB-A ports? Then these USB-A male to USB-C female adapters are made for you.Simply insert the adapter into the USB-A port on the device, and you can instantly connect your USB-C device to the device that originally didn't have the correct connection port.
- 【Trusted xiwxi Quality and Service】As a responsible brand seller, you will receive xiwxi's 12-month Quality assurance and lifetime friendly customer service, you're not just buying a product,you're investing in peace of mind with all-round quality and exceptional customer service.
Will disabling SMB Direct eliminate both KSMBD issues?
No. Disabling SMB Direct addresses the prerequisite for the SMB Direct integer-underflow report, but the protocol-dispatch race is a separate KSMBD path. You still need to check KSMBD itself, guest-share settings and the released kernel status.
Why might a vulnerability scanner show only a ZDI identifier?
The Linux kernel policy delays automatic CVE assignment until a fix is available and applied to a stable tree. Before that point, vendor tools may track the report under its ZDI-CAN identifier or an internal advisory number.
What logs should I review while waiting for a patch?
Review kernel and KSMBD service logs for unexpected crashes, restarts or malformed SMB activity, and correlate them with network connections to port 445. Logs cannot prove that the vulnerability was exploited, so treat anomalies as incident signals and preserve them for investigation.
