# Two CVSS 9.0 Linux KSMBD RCE Flaws (ZDI-CAN-33774, ZDI-CAN-33549) Disclosed on Public Mailing Lists Before Kernel Fixes

> Trend Micro's Zero Day Initiative disclosed two CVSS 9.0 remote code execution flaws in the Linux kernel's in-kernel SMB server (KSMBD) on public mailing lists before mainline fixes existed. ZDI-CAN-33774 is an unauthenticated race condition in protocol handler dispatch (SMB1 data processed by an SMB2 handler); ZDI-CAN-33549 is an integer underflow in the SMB Direct (RDMA) path. No CVE IDs have been assigned and no active exploitation or public PoC has been reported.

- **Published:** 2026-10-22T19:51:13Z
- **Last reviewed:** 2026-10-22T19:51:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4179
- **ID:** TL-2026-4179
- **Severity:** CRITICAL (CVSS 9)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-32252

## Description

On 2026-10-21/22 Trend Micro's Zero Day Initiative (ZDI) disclosed two critical flaws in KSMBD, the Linux kernel's in-kernel SMB3 file server, on public kernel mailing lists before fixes landed in the mainline kernel or linux-next. Neither flaw has a CVE yet; CVEs are normally assigned only once a fix reaches the stable trees. Both are rated CVSS 9.0 by the reporting sources. The base vector and the affected version range were not stated in the sources reviewed. One source states the flaws were tested on kernel 7.3-rc3. The Hacker News credits Trend Micro's AI scanner (TrendAI) as the finder; Threat Landscape credits HYEONTAE LEE, working with ZDI/TrendAI, for ZDI-CAN-33549.

ZDI-CAN-33774 is a race condition in how KSMBD assigns the protocol handler table, resulting in out-of-bounds memory access. It needs no authentication and is reachable on TCP port 445. A burst of short SMB1 packets followed immediately by an SMB2 packet in the same TCP write causes worker threads to process SMB1 data with an SMB2 handler (protocol handler confusion). Because KSMBD runs in kernel space, memory corruption here carries kernel-level impact.

ZDI-CAN-33549 is an integer underflow in smbdirect_connection_rdma_xmit() in the SMB Direct (RDMA) path. A client can supply RDMA buffer descriptors in which the first is longer than the declared payload. After the code clamps the length and sets the remaining buffer length to zero, it subtracts the original (unclamped) descriptor length. The unsigned size counter wraps to a very large value, and a subsequent memory copy can overrun the end of an allocated buffer. Exploitation requires an RDMA-capable network interface (hardware, or the rxe software driver), a writable KSMBD share, valid share access, and a client that negotiates SMB Direct. A fix was reportedly submitted by SMB Direct maintainer Stefan Metzmacher for the next kernel development cycle but had not landed in mainline or linux-next at publication.

Exposure is limited to hosts running the experimental KSMBD module. Red Hat has previously stated that KSMBD is not shipped or enabled in RHEL. Defenders can check with 'systemctl status ksmbd' and 'lsmod | grep ksmbd'. Mitigations are to unload and blacklist the module where unneeded, restrict TCP/445 at the firewall, and prefer userspace Samba for production. Earlier ZDI ksmbd research (disclosed 2022-12-22) produced a long series of kernel CVEs, which indicates the maintenance profile of this component.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1499.004 Application or System Exploitation
- T1046 Network Service Discovery

## Sources

- [Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes](https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html)
- [Unpatched KSMBD RCE Flaws ZDI-CAN-33774 and ZDI-CAN-33549 Disclosed - Threat Landscape](https://threatlandscape.io/blog/ksmbd-zdi-can-33774-33549-unpatched-rce)
- [Red Hat response to Zero Day Initiative ksmbd vulnerabilities](https://access.redhat.com/solutions/6991749)
- [KSMBD - Linux kernel documentation](https://www.kernel.org/doc/html/latest/filesystems/smb/ksmbd.html)
- [CVE-2023-32252 (prior ZDI-reported ksmbd flaw) - NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-32252)
- [ksmbd-tools releases](https://github.com/cifsd-team/ksmbd-tools/releases)
- [LKML disclosure of ZDI-CAN-33549 (SMB Direct integer underflow)](https://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/)
- [LKML disclosure of ZDI-CAN-33774 (handler table race)](https://lore.kernel.org/lkml/BYAPR01MB383076AC412E19C48CFBEAE980662@BYAPR01MB3830.prod.exchangelabs.com/)
- [Linux Kernel ksmbd Remote Code Execution Vulnerability - Kudelski Security bulletin](https://research.kudelskisecurity.com/2022/12/22/bulletin-linux-kernel-ksmbd-remote-code-execution-vulnerability/)
- [ZDI-23-694 - ksmbd advisory (prior ZDI ksmbd research)](https://www.zerodayinitiative.com/advisories/ZDI-23-694/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4179