1. Executive summary
Two remote code execution flaws in KSMBD, the SMB server built into the Linux kernel, were disclosed on public mailing lists on 2026-10-22 with no fix in the mainline kernel. Trend Micro's Zero Day Initiative rates both at 9.0. ZDI-CAN-33774 can be triggered before any network authentication; ZDI-CAN-33549 requires the SMB Direct transport and an RDMA-capable network. Any EMEA financial services estate running KSMBD on a reachable interface is exposed to unauthenticated remote code execution on the first flaw, and the absence of a kernel fix means patching is not currently available. No CVE has been assigned and no exploitation has been reported in the source.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
The source is a short news item. It confirms the existence of two flaws, their ZDI identifiers, their 9.0 rating, the pre-authentication property of one and the transport requirement of the other. It does not give affected kernel versions, the vulnerable functions, a proof-of-concept, or a disclosure timeline. The chain below is limited to what the source states.
- A Linux host runs KSMBD, the in-kernel SMB server, and exposes it on a network interface.
- For ZDI-CAN-33774, an attacker sends crafted SMB traffic to that interface. The flaw is reachable before any network authentication, so no credentials or session are needed.
- For ZDI-CAN-33549, the attacker must reach the host over SMB Direct with an RDMA-capable network path. That constraint narrows the exposed population to hosts with RDMA fabric in front of KSMBD.
- Successful exploitation yields remote code execution in kernel context. The source does not describe the post-exploitation path, so persistence, privilege escalation beyond the kernel context already gained, command-and-control, lateral movement and data access are not documented and are not asserted here.
The practical exposure question is which hosts run KSMBD at all. KSMBD is a kernel module that is not loaded by default on most distributions; it is enabled deliberately, typically on file servers or appliances that want in-kernel SMB without a userspace daemon such as Samba. Estates that never enabled it are not exposed to these flaws. Estates that did, and that expose the service beyond a management network, carry the full pre-authentication risk on ZDI-CAN-33774.
Both flaws are rated 9.0 by ZDI. No CVSS vector, CWE classification or NVD record is available, so the score cannot be decomposed into its attack vector, complexity and impact components from the source. No CVE identifier has been assigned, which means vulnerability scanners and CISA KEV tracking will not yet surface these flaws; detection depends on inventorying KSMBD directly.
The disclosure was made on public mailing lists before kernel fixes existed. That ordering matters for defenders: there is no vendor patch to apply, and the flaw details are already public. The source does not say whether a proof-of-concept was published, so the presence of working exploit code is unknown.
4. Mitigation & containment
No kernel fix exists, so containment is the only available control. The steps below follow from the source facts; where a command or path is not given in the source it is marked as an operational step to confirm against the host's distribution.
P1 within 24h
- Inventory every Linux host with the KSMBD module loaded:
lsmod | grep ksmbdandmodinfo ksmbd. Record which of those expose SMB (TCP 445) beyond a trusted management network. - On any host where KSMBD is not required, unload and blacklist the module:
modprobe -r ksmbdand addblacklist ksmbdunder/etc/modprobe.d/. Confirm the module does not reload after reboot. - On hosts where KSMBD is required, restrict TCP 445 to known management and backup source ranges at the host firewall and at the network edge. This removes internet and general-LAN reachability, which is the precondition for the pre-authentication flaw.
- For ZDI-CAN-33549, identify hosts with RDMA-capable interfaces (for example RoCE or InfiniBand adapters) fronting KSMBD and treat them as a separate, higher-scrutiny group. Where SMB Direct is not needed, disable it.
P2 within 72h
- Place KSMBD hosts behind network detection that alerts on SMB connection attempts from unexpected sources, and review SMB logs for anomalous pre-session traffic.
- Confirm no KSMBD host is reachable from partner, guest or internet-facing segments. Where it is, treat the host as potentially compromised and begin log review from the disclosure date.
P3 within 7 days
- Track the kernel mailing list and the distribution security trackers for the fix. When a patched kernel lands, stage it and roll it to KSMBD hosts first. Do not wait for a CVE to be assigned before scheduling the update; the fix will precede the identifier.
- Re-baseline the KSMBD inventory quarterly so the next in-kernel SMB flaw does not require a fresh discovery exercise.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source describes no atomic indicators and no observable behaviours beyond the transport and authentication properties already covered in §3. There is nothing to pivot on until a CVE, proof-of-concept or exploitation report appears.
6. Detection
Insufficient indicators to author detection rules.
The source gives no file artefacts, command lines, strings or log signatures specific to the flaws. A rule keyed on the ZDI identifiers or the product name would detect reporting about the flaws, not the flaws themselves, so none is emitted. Detection effort should go to the inventory and network-restriction steps in §4 until technical detail is published.
7. Sources
- The Hacker News, "Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes", https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html, 2026-10-22.
8. Adverse Trace position
Adverse Trace assesses this as a high-severity exposure for any estate that runs KSMBD on a reachable interface, driven by the pre-authentication reach of ZDI-CAN-33774 and the absence of a kernel fix. The rating of 9.0 is ZDI's; we have not independently re-scored it, and no CVE, CVSS vector or exploitation state is available to refine it. The single source is a news item summarising the mailing-list disclosure, so the technical detail is thin and single-sourced; clients should verify affected versions and any proof-of-concept against the original kernel mailing-list posts before acting beyond the containment steps above. Client impact is concentrated in file-server and appliance estates that enabled in-kernel SMB deliberately; most general-purpose Linux fleets do not load the module and are not exposed. We will monitor the kernel mailing list and distribution trackers for the fix and for a CVE assignment, and will issue an update when either lands or when exploitation is reported.
Published via PulseTrace — Adverse Trace threat intelligence.