Linux Servers Exposed to Two 9.0-Rated Remote Code Execution Flaws
Linux servers running KSMBD, the kernel’s built-in SMB server, face exposure to two remote code execution flaws rated 9.0 by Trend Micro’s Zero Day Initiative, according to a report by The Hacker News. Neither vulnerability has a named fix in the mainline kernel.
One vulnerability, tracked as ZDI-CAN-33774, requires no network authentication and exposes any server running KSMBD on port 445. The second flaw, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network interface.
How ZDI-CAN-33549 and ZDI-CAN-33774 Trigger Memory Overruns
ZDI-CAN-33549 operates as an integer underflow within KSMBD’s SMB Direct path. A client can supply RDMA buffer descriptors where the first is longer than the declared payload, causing the server’s size counter to wrap. This allows a subsequent memory copy to overrun the end of an allocated buffer.
Triggering ZDI-CAN-33549 requires an RDMA-capable interface, which can be hardware or the rxe software driver, alongside a writable KSMBD share and a client negotiating SMB Direct. Meanwhile, ZDI-CAN-33774 involves a race condition in how KSMBD assigns its handler table. Workers process SMB1 data using an SMB2 handler when a TCP write delivers a burst of brief SMB1 packets followed by an SMB2 packet, which results in reads exceeding the boundaries of the shorter buffer.
Kernel Maintainers Face Unpatched Submissions
As of Thursday, neither KSMBD flaw possesses a named fix in the mainline kernel or in linux-next, the integration tree that feeds it. Although unverified by other sources, Linux news publication Phoronix stated that Stefan Metzmacher, the SMB Direct maintainer, provided a patch for ZDI-CAN-33549 intended for the upcoming kernel development cycle. Fixes entering mainline typically take weeks to reach stable branches and distribution kernels afterward.
Neither vulnerability holds a CVE identifier, as the kernel project assigns those only after a stable-tree fix becomes available. The Zero Day Initiative reports credited TrendAI, Trend Micro’s AI scanner, as the finder. Under Linux kernel security documentation updated in May 2026 following guidance from Linus Torvalds, bugs discovered by AI tools are considered public by definition and must go to subsystem developer lists. ZDI routed its reports accordingly, copying public mailing lists alongside the private kernel security address without attaching patches.
Stable-kernel maintainer Greg Kroah-Hartman replied to three of the five kernel reports within minutes. Addressing the VMware GPU driver report, he wrote that sending items to public lists without a patch leaves developers unable to act. Seventeen seconds later, regarding the NVMe driver report, he asked for the submission process to be fixed.
Frequently Asked Questions About KSMBD Vulnerabilities
How can administrators confirm if KSMBD is active on a system?
Administrators can run systemctl status ksmbd or lsmod | grep ksmbd to check whether the module is active. Red Hat Enterprise Linux does not include KSMBD by default, as noted in Red Hat support documentation.
Are there any additional non-kernel vulnerabilities associated with these reports?
A sixth ZDI report, tracked as ZDI-CAN-32005, involves a buffer overflow in ConnMan, which is a network daemon separate from the Linux kernel.
Keep reading