KSMBD Zero-Day Alert: Two Unpatched CVSS 9.0 Linux RCE Flaws Exposed on Public Mailing Lists
Executive Summary
In October 2026, Trend Micro's Zero Day Initiative publicly disclosed two critical remote code execution vulnerabilities in the Linux kernel's KSMBD SMB server module, each rated CVSS 9.0, before any mainline kernel patch was available. ZDI-CAN-33774 requires no authentication and affects any Linux server with KSMBD active on port 445, exploiting a race condition in SMB protocol dispatch. ZDI-CAN-33549 targets SMB Direct over RDMA via an integer underflow enabling heap overflow. Neither flaw has received a CVE or upstream fix, leaving exposed systems in a prolonged window of unmitigated risk across enterprise Linux file-serving environments.
The premature public disclosure—driven by a policy that AI-discovered bugs are inherently public—highlights a growing tension between responsible disclosure norms and AI-accelerated vulnerability research. With no patch and no CVE assigned, defenders have limited tooling to prioritize or track remediation, increasing the urgency for network-layer controls such as segmentation, egress filtering, and inline IPS to compensate while kernel fixes work through distribution pipelines.
Why This Matters Now
Two CVSS 9.0 Linux KSMBD flaws were disclosed publicly on kernel mailing lists before any patch existed, leaving SMB servers exposed with no CVE for tracking and no vendor fix imminent. With AI-driven vulnerability discovery accelerating disclosure timelines, defenders must now rely on network controls—segmentation, inline IPS, and egress policy—to contain risk that patch management alone cannot address in time.
Attack Path Analysis
An attacker exploits one of two unpatched CVSS 9.0 remote code execution vulnerabilities in the Linux KSMBD kernel SMB server — either the pre-authentication race condition (ZDI-CAN-33774) via a crafted burst of SMB1/SMB2 packets on port 445, or the SMB Direct integer underflow (ZDI-CAN-33549) via RDMA buffer descriptor manipulation — to achieve unauthenticated kernel-level code execution on the target host. With kernel-level access established, the attacker escalates to full root, moves laterally across reachable SMB-adjacent workloads, establishes covert command-and-control channels, exfiltrates sensitive data over unencrypted paths, and ultimately disrupts or destroys the compromised environment.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker scans the network for Linux hosts with KSMBD active on TCP port 445. For hosts reachable without authentication, ZDI-CAN-33774 is triggered by sending a crafted burst of short SMB1 packets followed by an SMB2 packet in the same TCP write, causing workers to process SMB1 data with an SMB2 handler and overrun a kernel buffer — achieving pre-authentication remote code execution. Alternatively, against an RDMA-capable host with a writable KSMBD share, ZDI-CAN-33549 is triggered via malformed RDMA buffer descriptors causing an integer underflow and heap overwrite. No CVE identifiers or mainline kernel patches exist at time of exploitation, maximizing attacker window. CNSF Inline IPS (Suricata) with signatures for malformed SMB protocol sequences could detect and block the exploit traffic at the network boundary before it reaches the KSMBD listener.
MITRE ATT&CK® Techniques
Exploitation of Remote Services
Exploit Public-Facing Application
Exploitation for Client Execution
Exploitation for Privilege Escalation
Endpoint Denial of Service
Network Service Discovery
Impair Defenses
Command and Scripting Interpreter
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation
Control ID: SI-2
PCI DSS 4.0 – All System Components Are Protected from Known Vulnerabilities
Control ID: Requirement 6.3.3
DORA (Digital Operational Resilience Act) – ICT Risk Management and Vulnerability Handling
Control ID: Article 9 – ICT Security Policies and Tools
NIS2 Directive – Vulnerability Handling and Patch Management
Control ID: Article 21 – Cybersecurity Risk Management Measures
CISA Zero Trust Maturity Model 2.0 – Network Segmentation and Lateral Movement Prevention
Control ID: Network Pillar – Micro-Segmentation
NYDFS 23 NYCRR 500 – Vulnerability and Patch Management for Critical Systems
Control ID: Section 500.7 – Access Privileges and Management
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Linux KSMBD RCE flaws (CVSS 9.0) directly threaten IT infrastructure running SMB file servers; unpatched kernel vulnerabilities enable pre-auth lateral movement and exfiltration, violating NIST.800-53.SC-7 and ZTMM.Network controls.
Government Administration
Federal and municipal Linux deployments using KSMBD on port 445 face unauthenticated RCE exposure; no CVE or patch exists, creating critical compliance gaps under NIST.CSF.PR.AC-4 and ZTMM zero trust segmentation mandates.
Financial Services
Financial sector Linux file-sharing servers exposed to KSMBD integer underflow and race condition RCE risk data exfiltration; PCI.4.0.4.2.1 and HIPAA.164.312(e)(1) encryption-in-transit controls remain undermined without kernel patching.
Health Care / Life Sciences
Healthcare Linux environments running KSMBD risk unauthenticated remote code execution enabling lateral movement across clinical networks; HIPAA.164.308(a)(3) and HIPAA.164.312(b) audit controls are critically jeopardized pending mainline kernel fixes.
Sources
- Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixeshttps://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.htmlVerified
- ZDI-CAN-33549 LKML Disclosure Thread - SMB Direct Integer Underflowhttps://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/Verified
- ZDI-CAN-33774 LKML Disclosure Thread - KSMBD Protocol Dispatch Racehttps://lore.kernel.org/lkml/BYAPR01MB383076AC412E19C48CFBEAE980662@BYAPR01MB3830.prod.exchangelabs.com/Verified
- Trend Micro Zero Day Initiative Upcoming Advisorieshttps://www.zerodayinitiative.com/advisories/upcomingVerified
- Phoronix - New Trend Micro ZDI Vulnerabilities Reported to LKMLhttps://www.phoronix.com/news/LKML-New-Trend-VulnerabilitiesVerified
- Linux Kernel CVE Assignment Process Documentationhttps://docs.kernel.org/process/cve.htmlVerified
- Linux Kernel Security Bug Reporting Documentationhttps://docs.kernel.org/process/security-bugs.htmlVerified
- Red Hat Support - KSMBD Availability in RHELhttps://access.redhat.com/solutions/6991749Verified
- linux-next SMB Subsystem Commit Loghttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/log/fs/smbVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant because both KSMBD vulnerabilities rely on unauthenticated network reachability to port 445, and all post-exploitation stages depend on unrestricted east-west and egress paths that Zero Trust segmentation would likely constrain. By reducing lateral reachability and controlling outbound traffic, CNSF would likely limit how far an attacker could propagate after achieving kernel-level access on a single host.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline IPS inspection of SMB protocol traffic at the network boundary would likely detect malformed packet sequences associated with the exploit attempts, and network-level reachability controls could reduce the pool of hosts exposed to unauthenticated port 445 access from untrusted sources.
Control: Zero Trust Segmentation
Mitigation: Even after kernel compromise, Zero Trust segmentation enforcing least-privilege identity-based policies on the KSMBD workload would likely constrain the scope of what that compromised identity can reach, reducing the automatic propagation of elevated privileges to adjacent services or network segments.
Control: East-West Traffic Security
Mitigation: East-west enforcement through workload-to-workload segmentation would likely reduce the number of reachable pivot targets from the compromised KSMBD host, and anomalous lateral SMB or SSH connections originating from that workload could surface as policy violations or generate detection telemetry.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across the cloud environment would likely surface unexpected outbound connections from the KSMBD host, and FQDN-based egress filtering could block unauthorized outbound destinations before a persistent C2 channel is stabilized.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement with FQDN filtering would likely block transfers to unauthorized external destinations, and inline inspection could detect bulk outbound data transfers that match exfiltration patterns, meaningfully reducing the volume of data that successfully leaves the environment.
If prior CNSF controls successfully limited lateral reachability and egress paths, the attacker's destructive impact would likely be scoped to the initially compromised host and the SMB shares directly accessible to it, rather than propagating across the broader workload environment.
Impact at a Glance
Affected Business Functions
- File and Storage Sharing Services (SMB/CIFS)
- Linux Server Infrastructure Operations
- Network-Attached Storage (NAS) and Data Access Services
- Enterprise Workload and Compute Environments
Estimated downtime: 30 days
Estimated loss: N/A
Any Linux system running the KSMBD kernel module and exposing port 445 is at risk of unauthenticated remote code execution via ZDI-CAN-33774 prior to a patch reaching stable kernels. Successful exploitation could result in full kernel-level compromise, enabling exfiltration of all data hosted on or accessible from the affected server, including file shares, credentials, configuration data, and any sensitive business or customer data stored on the system. ZDI-CAN-33549 additionally targets environments with RDMA-capable networking hardware running SMB Direct, which is common in high-performance computing and enterprise storage architectures. With no CVE assigned and no mainline fix available, patch timelines for stable distributions may extend weeks to months, leaving affected servers exposed for an extended window. No confirmed exploitation in the wild has been reported at time of publication.
Recommended Actions
Key Takeaways & Next Steps
- • Immediately disable KSMBD (
systemctl stop ksmbd && systemctl disable ksmbd) on any Linux host where SMB kernel sharing is not operationally required, and verify module absence withlsmod | grep ksmbd; restrict port 445 at the cloud firewall layer using CNSF Cloud Firewall (ACF) egress and ingress controls to prevent internet-exposed exploitation until mainline kernel patches are available. - • Deploy CNSF Inline IPS (Suricata) with SMB protocol anomaly and exploit-pattern signatures at network ingress points to detect and block malformed SMB1/SMB2 burst patterns associated with ZDI-CAN-33774 and malformed RDMA buffer descriptor sequences associated with ZDI-CAN-33549, reducing initial compromise probability.
- • Enforce CNSF Zero Trust Segmentation with identity-based SmartGroup policies to isolate KSMBD-hosting workloads into least-privilege network segments, ensuring that even a kernel-level compromise cannot automatically propagate privileges or initiate connections to adjacent workloads without explicit policy authorization.
- • Activate CNSF East-West Traffic Security monitoring on all internal workload-to-workload flows to baseline normal SMB and SSH lateral communication patterns, enabling rapid detection of anomalous pivoting activity originating from any compromised KSMBD host.
- • Implement CNSF Egress Security & Policy Enforcement with FQDN-based filtering and CNSF Multicloud Visibility & Control to block unauthorized outbound C2 and exfiltration channels from Linux workloads, ensuring that post-exploitation reverse shells and bulk data transfers to attacker infrastructure are detected and terminated before data loss or persistent access is established.
