Two CVSS 9.0 RCE Flaws Disclosed in Linux KSMBD Before Kernel Fixes

Public Disclosure of Critical KSMBD Flaws

Two remote code execution (RCE) vulnerabilities, ZDI-CAN-33774 and ZDI-CAN-33549, have been publicly reported in Linux KSMBD, the kernel's in-built SMB server. Trend Micro's Zero Day Initiative (ZDI) rated both flaws with a CVSS score of 9.0. As of the disclosure, no official fixes have been integrated into the mainline Linux kernel.

Details of the Vulnerabilities

ZDI-CAN-33774 is a pre-authentication RCE, meaning it can be triggered without any network authentication, exposing any server running KSMBD on port 445. This flaw involves a race condition where KSMBD assigns its handler table, allowing SMB1 data to be processed by an SMB2 handler, leading to a buffer over-read.

ZDI-CAN-33549 is an integer underflow in KSMBD's SMB Direct path. Exploitation requires the SMB Direct transport, an RDMA-capable network interface, a writable KSMBD share, and a client negotiating SMB Direct. This flaw allows a memory copy to overrun an allocated buffer.

Lack of Official Fixes and CVEs

Neither vulnerability has a named fix in the mainline kernel or in the linux-next integration tree. While a fix for ZDI-CAN-33549 was reportedly submitted for the next kernel development cycle, this remains unconfirmed. Fixes typically take weeks to propagate from mainline to stable branches and distribution kernels. Neither flaw has a CVE identifier, as the kernel project assigns these only after a stable-tree fix is available.

Impact and Mitigation

Linux servers running KSMBD are exposed to these RCE flaws. Users can check if KSMBD is active using `systemctl status ksmbd` or `lsmod | grep ksmbd`. Red Hat Enterprise Linux does not include KSMBD by default. The flaws were discovered by Trend Micro's AI scanner, TrendAI, and disclosed according to updated Linux kernel security documentation, which advises public disclosure for AI-found bugs.