Threat reportVulnerabilityTL-2026-4179
Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774, ZDI-CAN-33549) Disclosed on Public Mailing Lists Before Kernel Fixes
Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774 (TL-2026-4179), also tracked as ZDI-CAN-33774, is a critical-severity software vulnerability scored CVSS 9, first published 2026-10-22. It has no confirmed attribution, affects Linux Kernel KSMBD (in-kernel SMB3 server, CONFIG_SMB_SERVER), references 1 CVE (CVE-2023-32252), maps to 3 MITRE ATT&CK techniques (T1046, T1190, T1499.004), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4179
- Threat ID
- TL-2026-4179
- Also known as
- ZDI-CAN-33774, ZDI-CAN-33549
- Severity
- CRITICAL
- CVSS
- 9
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, telecoms, government administration, storage, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
How Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774 works
Trend Micro's Zero Day Initiative disclosed two CVSS 9.0 remote code execution flaws in the Linux kernel's in-kernel SMB server (KSMBD) on public mailing lists before mainline fixes existed. ZDI-CAN-33774 is an unauthenticated race condition in protocol handler dispatch (SMB1 data processed by an SMB2 handler); ZDI-CAN-33549 is an integer underflow in the SMB Direct (RDMA) path. No CVE IDs have been assigned and no active exploitation or public PoC has been reported.
On 2026-10-21/22 Trend Micro's Zero Day Initiative (ZDI) disclosed two critical flaws in KSMBD, the Linux kernel's in-kernel SMB3 file server, on public kernel mailing lists before fixes landed in the mainline kernel or linux-next. Neither flaw has a CVE yet; CVEs are normally assigned only once a fix reaches the stable trees. Both are rated CVSS 9.0 by the reporting sources. The base vector and the affected version range were not stated in the sources reviewed. One source states the flaws were tested on kernel 7.3-rc3. The Hacker News credits Trend Micro's AI scanner (TrendAI) as the finder; Threat Landscape credits HYEONTAE LEE, working with ZDI/TrendAI, for ZDI-CAN-33549.
ZDI-CAN-33774 is a race condition in how KSMBD assigns the protocol handler table, resulting in out-of-bounds memory access. It needs no authentication and is reachable on TCP port 445. A burst of short SMB1 packets followed immediately by an SMB2 packet in the same TCP write causes worker threads to process SMB1 data with an SMB2 handler (protocol handler confusion). Because KSMBD runs in kernel space, memory corruption here carries kernel-level impact.
ZDI-CAN-33549 is an integer underflow in smbdirect_connection_rdma_xmit() in the SMB Direct (RDMA) path. A client can supply RDMA buffer descriptors in which the first is longer than the declared payload. After the code clamps the length and sets the remaining buffer length to zero, it subtracts the original (unclamped) descriptor length. The unsigned size counter wraps to a very large value, and a subsequent memory copy can overrun the end of an allocated buffer. Exploitation requires an RDMA-capable network interface (hardware, or the rxe software driver), a writable KSMBD share, valid share access, and a client that negotiates SMB Direct. A fix was reportedly submitted by SMB Direct maintainer Stefan Metzmacher for the next kernel development cycle but had not landed in mainline or linux-next at publication.
Exposure is limited to hosts running the experimental KSMBD module. Red Hat has previously stated that KSMBD is not shipped or enabled in RHEL. Defenders can check with 'systemctl status ksmbd' and 'lsmod | grep ksmbd'. Mitigations are to unload and blacklist the module where unneeded, restrict TCP/445 at the firewall, and prefer userspace Samba for production. Earlier ZDI ksmbd research (disclosed 2022-12-22) produced a long series of kernel CVEs, which indicates the maintenance profile of this component.
MITRE ATT&CK techniques used in TL-2026-4179
Discovery
T1046 Network Service Discovery
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774
- Linux Kernel — KSMBD (in-kernel SMB3 server, CONFIG_SMB_SERVER)
Vulnerable versions: Tested on 7.3-rc3; full affected range not published
Remediation for Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774
Patches
- No mainline or linux-next fix available for ZDI-CAN-33774 as of 2026-10-22
- ZDI-CAN-33549 fix reportedly submitted by Stefan Metzmacher for the next kernel cycle (not yet merged)
Immediate actions
- Identify hosts running KSMBD: systemctl status ksmbd; lsmod | grep ksmbd; grep SMB_SERVER /boot/config-$(uname -r)
- Unload (modprobe -r ksmbd) and blacklist the ksmbd module on hosts that do not need it
- Restrict inbound TCP/445 to trusted clients at host and perimeter firewalls
- Where SMB Direct is not required, do not expose RDMA-capable interfaces or rxe devices to untrusted clients
Workarounds
- Disable or blacklist the ksmbd module
- Firewall TCP/445
- Restrict writable KSMBD shares and authentication to trusted users
Longer-term hardening
- Prefer userspace Samba over in-kernel KSMBD for production file serving
- Monitor LKML, linux-cifs and the stable trees for the fixes and CVE assignments
- Alert on unexpected loading of the ksmbd kernel module and on new listeners on port 445
CVEs associated with Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774
Weaknesses (CWE) in Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774
Timeline of Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774
- KSMBD, the in-kernel SMB3 server, was merged into the mainline kernel (Linux 5.15) as an experimental module (CONFIG_SMB_SERVER).
- ZDI disclosed an earlier batch of ksmbd vulnerabilities, which Red Hat addressed by confirming KSMBD is not shipped in its products.
- NVD published earlier ZDI-reported ksmbd kernel CVEs (e.g. CVE-2023-32252), showing a recurring vulnerability pattern in the component.
- ZDI-CAN-33774 and ZDI-CAN-33549 disclosed on public kernel mailing lists via Trend Micro's Zero Day Initiative, before mainline fixes; tested on kernel 7.3-rc3.
- Two separate ZDI posts to LKML on lore.kernel.org describe ZDI-CAN-33774 (handler table race) and ZDI-CAN-33549 (SMB Direct integer underflow); disclosure batch reportedly covers five kernel flaws including networking stack, VMware GPU and NVMe target driver bugs.
- Fix for ZDI-CAN-33549 reportedly submitted by SMB Direct maintainer Stefan Metzmacher for the next kernel development cycle; not yet merged.
- No named fix in mainline or linux-next for either flaw and no CVE identifiers assigned (CVEs are issued after stable-tree fixes).
- The Hacker News and other outlets reported the disclosures; both flaws rated CVSS 9.0.
Sources cited for Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774
- Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
- Unpatched KSMBD RCE Flaws ZDI-CAN-33774 and ZDI-CAN-33549 Disclosed - Threat Landscape
- Red Hat response to Zero Day Initiative ksmbd vulnerabilities
- KSMBD - Linux kernel documentation
- CVE-2023-32252 (prior ZDI-reported ksmbd flaw) - NVD
- ksmbd-tools releases
- LKML disclosure of ZDI-CAN-33549 (SMB Direct integer underflow)
- LKML disclosure of ZDI-CAN-33774 (handler table race)
- Linux Kernel ksmbd Remote Code Execution Vulnerability - Kudelski Security bulletin
- ZDI-23-694 - ksmbd advisory (prior ZDI ksmbd research)
Detection coverage for TL-2026-4179
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4179 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.