{
  "id": 16085608,
  "title": "Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes",
  "url": "https://urgent.news/2026/10/22/two-cvss-9-0-linux-ksmbd-rce-flaws-disclosed-on-public-mailing-lists",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-22T17:01:53.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html"
  },
  "original_language": "en",
  "account": "Two critical remote code execution (RCE) vulnerabilities were recently disclosed for the Linux KSMBD SMB server. Both flaws, ZDI-CAN-33774 and ZDI-CAN-33549, were rated 9.0 by security firm Trend Micro's Zero Day Initiative. The first flaw, ZDI-CAN-33774, can be exploited without any network authentication and affects any KSMBD server running on port 445. It occurs due to a race condition in how KSMBD handles SMB1 and SMB2 packets, allowing an attacker to read data beyond the allocated buffer. The second flaw, ZDI-CAN-33549, requires RDMA-capable hardware or the rxe software driver, a writable KSMBD share, and an SMB Direct-enabled client. It happens due to an integer underflow in the server's SMB Direct path, causing a memory overrun. Neither flaw has been patched in the mainline kernel or linux-next, as of Thursday. While a fix for ZDI-CAN-33549 is reportedly in the next kernel development cycle, it is uncertain if it will reach stable branches and distribution kernels in a timely manner. The ZDI reports credit their AI scanner, TrendAI, for discovering the vulnerabilities. Despite following Trend Micro's AI tool guidelines, the reports were sent to public mailing lists without patches attached, causing Linux kernel maintainer Greg Kroah-Hartman to express frustration over their submission process.",
  "summary": "Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}