Threat reportVulnerabilityTL-2026-4206
Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE ZDI-CAN-33774 / ZDI-CAN-33549, skb_zerocopy LPE and others) Accidentally Disclosed on Public Mailing Lists
Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE (TL-2026-4206), also tracked as ZDI-CAN-33774, is a critical-severity software vulnerability scored CVSS 9, first published 2026-10-23. It has no confirmed attribution, affects Linux Kernel ksmbd (in-kernel SMB server), references 1 CVE (CVE-2024-26592), maps to 3 MITRE ATT&CK techniques (T1078.001, T1190, T1499.004), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4206
- Threat ID
- TL-2026-4206
- Also known as
- ZDI-CAN-33774, ZDI-CAN-33549, ZDI-CAN-33367, ZDI-CAN-34068, ZDI-CAN-34076, ZDI-CAN-32005
- Severity
- CRITICAL
- CVSS
- 9
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, telecoms, government administration, finance, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
How Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE works
Trend Micro's Zero Day Initiative accidentally copied six unpatched vulnerability reports to public Linux kernel mailing lists on 20-21 October 2026, including two CVSS 9.0 remote code execution flaws in KSMBD, the in-kernel SMB server. No CVE IDs had been assigned and no fixes were in the mainline kernel at the time of reporting; public reproduction details exist for several of the bugs.
On 20 October 2026 (ConnMan) and 21 October 2026 (five kernel reports), Trend Micro's Zero Day Initiative (ZDI) sent vulnerability reports intended for the private security@kernel.org list and also copied public lists including linux-kernel (LKML), linux-cifs, netdev and dri-devel. The reports were published with KASAN traces, code paths and, for some, full proof-of-concept source, before any patch or CVE existed. Stable-kernel maintainer Greg Kroah-Hartman replied to several reports criticising the public submission and the absence of patches. Per pwn.watch, formal ZDI advisories are scheduled for February 2027. Cyber Kendra attributes the finding to TrendAI, Trend Micro's AI vulnerability scanner.
The two highest-rated flaws are in KSMBD (the Linux in-kernel SMB3 server, off by default upstream and mostly seen on NAS devices and ARM boards such as Armbian; Red Hat Enterprise Linux does not ship it by default). ZDI-CAN-33774 (CVSS 9.0) is a pre-authentication race in KSMBD's protocol handler dispatch: a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write on port 445 causes workers to process SMB1 data with the SMB2 handler, reading past the end of the shorter buffer. TuxCare reports this leaks about 28 bytes of kernel heap per attempt and can crash the kernel; pwn.watch states exploitation needs a guest-accessible share. A fix (commit 68f410faedaf) sits in the ksmbd maintainer tree but not mainline. ZDI-CAN-33549 (CVSS 9.0) is an integer underflow in the SMB Direct (RDMA) path: a client supplies RDMA buffer descriptors whose first entry is longer than the declared payload, wrapping the server's size counter so a later memory copy overruns an allocated buffer (heap overflow of up to about 8 KB per TuxCare). It requires CONFIG_SMB_SERVER_SMBDIRECT, an RDMA-capable interface and a writable share; a fix is reportedly queued for Linux 7.5 (Stefan Metzmacher's for-7.5/smbdirect branch, unconfirmed).
The remaining reports: ZDI-CAN-33367 (CVSS 7.8) is a local privilege escalation in skb_zerocopy() where the SKBFL_SHARED_FRAG guard flag is not carried over, allowing in-place ESP decryption to write to page-cache pages of read-only files. TuxCare reports it bypasses the May 2026 Dirty Frag fix (CVE-2026-43284) and yields root on AlmaLinux 8/9/10, CloudLinux 9/10, Debian 12/13 and Ubuntu 24.04/26.04 (including AppArmor restrictions); a one-line patch was posted to netdev on 22 October but not merged. ZDI-CAN-34068 (vmwgfx, out-of-bounds write LPE, CVSS 8.8) and ZDI-CAN-34076 (nvmet NVMe-oF target, uninitialized memory information disclosure, CVSS 8.6) have little published technical detail. ZDI-CAN-32005 is a stack buffer overflow in the ConnMan network daemon (not a kernel component). Testing was reported on Linux 7.3-rc1/rc3 (Debian trixie); full affected-version ranges were not disclosed.
No in-the-wild exploitation has been reported in the sources reviewed. Status ACTIVE reflects the unpatched, publicly documented state. Defenders should confirm whether KSMBD is loaded or enabled, remove it where unneeded, keep SMB (TCP 445) off untrusted networks, and restrict unprivileged user namespaces pending distribution fixes.
MITRE ATT&CK techniques used in TL-2026-4206
Initial Access
T1078.001 Valid Accounts: Default Accounts; T1190 Exploit Public-Facing Application
Impact
T1499.004 Endpoint Denial of Service: Application or System Exploitation
Affected products and versions in Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE
- Linux Kernel — ksmbd (in-kernel SMB server)
Vulnerable versions: Mainline without named fix as of 2026-10-23; tested on 7.3-rc1 and 7.3-rc3
Fixed in: ZDI-CAN-33774: commit 68f410faedaf in ksmbd maintainer tree (not mainline); ZDI-CAN-33549: reportedly queued for 7.5 (unconfirmed) - Linux Kernel — net/core skb_zerocopy (ZDI-CAN-33367)
Vulnerable versions: AlmaLinux 8, 9, 10; CloudLinux 9, 10; Debian 12, 13; Ubuntu 24.04, 26.04 - Linux Kernel — vmwgfx DRM driver (ZDI-CAN-34068) and nvmet NVMe-oF target (ZDI-CAN-34076)
Vulnerable versions: Not disclosed - ConnMan — ConnMan network manager (ZDI-CAN-32005)
Vulnerable versions: Not disclosed
Remediation for Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE
Patches
- No mainline fix at time of reporting; ZDI-CAN-33774 fix is commit 68f410faedaf in the ksmbd maintainer tree; ZDI-CAN-33549 fix reportedly queued for Linux 7.5; ZDI-CAN-33367 one-line patch posted to netdev, under review
- TuxCare KernelCare rebootless patch work started for EL kernels; no ETA
Immediate actions
- Check whether KSMBD is in use: systemctl status ksmbd, systemctl is-active ksmbd, lsmod | grep ksmbd
- Disable KSMBD if not required (modprobe -r ksmbd) and block TCP 445 from untrusted/internet-facing networks
- Remove guest-accessible SMB shares; leave SMB Direct disabled unless RDMA is required
- For skb_zerocopy LPE (ZDI-CAN-33367), disable unprivileged user namespaces: user.max_user_namespaces = 0 via /etc/sysctl.d
- Optionally block rarely used modules nlmon and act_pedit via modprobe install /bin/false
Workarounds
- Unload/disable ksmbd module
- Network segmentation of file-sharing services
- Restrict unprivileged user namespaces
Longer-term hardening
- Monitor distribution security trackers and vendor advisories for backported fixes once CVEs are assigned
- Prefer Samba (userspace) over in-kernel KSMBD for SMB serving where feasible
- Inventory NAS devices and ARM boards that ship KSMBD enabled
CVEs associated with Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE
Weaknesses (CWE) in Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE
Timeline of Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE
- ZDI publishes ZDI-24-195 (CVE-2024-26592), an earlier ksmbd TCP connection race condition RCE rated CVSS 9.0, showing a recurring class of ksmbd flaws
- Dirty Frag fix (CVE-2026-43284) released in May 2026; ZDI-CAN-33367 later reported to bypass it (exact day not stated in sources)
- ZDI-26-573, a pre-auth ksmbd leak rated CVSS 9.3, published in August 2026 (exact day not stated in sources)
- ZDI report for ConnMan stack buffer overflow (ZDI-CAN-32005) posted to a public list
- Five ZDI kernel reports (ZDI-CAN-33774, 33549, 33367, 34068, 34076) sent to security@kernel.org and mistakenly copied to LKML, linux-cifs, netdev and dri-devel with technical details and, for some, PoC source
- Greg Kroah-Hartman criticises public submission without patches; Phoronix and Slashdot report; one-line skb_zerocopy patch posted to netdev for review
- Cyber Security News and The Hacker News report no CVEs assigned and no mainline fix for the two KSMBD RCE flaws
- Formal ZDI advisories reportedly scheduled for February 2027 (per pwn.watch; exact day not stated)
Sources cited for Unpatched Linux Kernel Flaws (KSMBD Pre-Auth RCE
- Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List (Cyber Security News)
- Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes (The Hacker News)
- Linux Kernel skb_zerocopy Zero Day Gets Root on AlmaLinux, Debian and Ubuntu and Bypasses the Dirty Frag Fix (TuxCare)
- Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (pwn.watch)
- Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List (Phoronix)
- Linux KSMBD RCE Flaws Disclosed Unpatched by Trend Micro ZDI (Cyber Kendra)
- Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List (Slashdot)
- Unpatched Linux kernel vulnerabilities accidentally emailed to public mailing list (Neowin)
- ZDI-24-195: Linux Kernel ksmbd TCP Connection Race Condition RCE (CVE-2024-26592), prior ksmbd race for context
Detection coverage for TL-2026-4206
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4206 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.