Hardware Ready Ready to Bench?
Trend Micro inadvertently sent five vulnerability reports to the public Linux kernel mailing list. Two of these concern KSMBD, the SMB server integrated into the kernel, with a CVSS score of 9.0 and potential risk of remote code execution, currently lacking patches in the mainline version or an assigned CVE identifier.
Trend Micro’s Zero Day Initiative (ZDI) reported these Linux kernel vulnerabilities to maintainers via the private security list, but erroneously included the public mailing lists of the affected subsystems. The reports, sent on the evening of October 21, thus became publicly accessible before fixes were available in the mainline kernel.
KSMBD vulnerabilities: why it matters
Greg Kroah-Hartman, responsible for maintaining stable kernel branches, responded to three of the five reports within minutes, asking for clarification on the sending to public lists and the lack of an attached patch. Regarding the VMware graphics driver, he stated: “For some reason it was sent to public lists and without a patch, so we cannot do much.” The response regarding the NVMe driver was nearly identical: “Again no patch, and sent to a public list? Fix your submission process.”
ZDI defended its report format, noting that it had handled about one thousand cases in ten years with the same setup. It explained that it could not bear the costs necessary for developing patches and reiterated that it publishes vulnerability details 120 days after vendor refusal or non-response. ZDI did not provide comments on the presence of public lists in copy.
ZDI-CAN-33549 is an integer underflow present in the SMB Direct path of KSMBD, within the smbdirect_connection_rdma_xmit() function. A malicious client could send two RDMA buffer descriptors where the first declares a length greater than the actual payload. The remaining size counter, after being zeroed by a clamp check, is further decremented falling below zero and causing an overflow. This allows the second descriptor to bypass the clamp check, enabling a subsequent memory copy operation to write beyond the limits of the allocated buffer, with a potential heap overflow up to 8 KB. Exploitation requires a network interface equipped with RDMA capabilities (hardware or software rxe driver), a writable KSMBD share, and a client that negotiates SMB Direct transport.
ZDI-CAN-33774 is instead a race condition in how KSMBD assigns the protocol handler table. A sequence of short SMB1 packets, followed by an SMB2 packet on the same TCP connection, could lead to SMB1 data being processed by a handler designed for SMB2, resulting in reading beyond the limits of the shorter buffer. There is also a possible access path that allows writing beyond this limit after gaining access to a share. Unlike the first vulnerability, this one does not require authentication: it is sufficient that the server has KSMBD active on port 445.
The proof of concepts published with the reports demonstrate a kernel heap memory leak and system crash, but actual code execution has not been publicly demonstrated. At present, no evidence of active exploitation in the wild has been reported.
Neither vulnerability has currently received a fix in the mainline kernel or the linux-next branch, which feeds kernel development. Regarding ZDI-CAN-33774, Namjae Jeon, the KSMBD maintainer, communicated that the fix is already present in his development tree with commit 68f410faedaf, but has not yet been integrated into mainline. For ZDI-CAN-33549 there is a patch from Stefan Metzmacher, the SMB Direct transport maintainer, in a Git branch destined for version 7.5, which could be accelerated: the maintainer believes the patch may also resolve this vulnerability, but this has not yet been confirmed.
Neither vulnerability has also received a CVE (Common Vulnerabilities and Exposures) identifier: the kernel project assigns a CVE only after a fix is available on a stable branch. Once the patch is integrated into mainline, application to stable branches and subsequent distributions typically requires several weeks.
ZDI set the publication date for its advisories regarding these five kernel reports to February 18, 2027, at the end of the 120-day period. Linux server administrators can check if KSMBD is active using the commands systemctl status ksmbd or lsmod | grep ksmbd.
What changes and what are the effects
Red Hat Enterprise Linux does not include the KSMBD module, as indicated in Red Hat’s support documentation. Similarly, AlmaLinux and CloudLinux 9 and 10 do not compile it at all. Debian and Ubuntu compile it as a module, but load it only if the administrator installs the ksmbd-tools package and starts the service; Ubuntu also includes support for SMB Direct transport, while Debian does not.
It is important to note that KSMBD should not be confused with Samba, the most widespread SMB server, which operates in user space and is not involved in these vulnerabilities.
The Linux kernel security documentation, updated in May 2026 on Linus Torvalds’ instruction, establishes that bugs identified using artificial intelligence-based tools are to be considered already public and can be sent to the competent subsystem lists. Some of the ZDI reports appear associated with TrendAI, Trend Micro’s AI-based scanner, while for the two KSMBD defects the ZDI advisory list indicates researcher Hyeontae Lee as the discoverer. Initial reconstructions suggest that the publication was an accident and not a deliberate application of the aforementioned policy.
Of the other three reports, none concerns KSMBD, but one is probably the most relevant for most systems. ZDI-CAN-33367, a local privilege escalation in the skb_zerocopy function of the network stack with CVSS 7.8, was discovered by researcher p1r0x. The defect bypasses the fix for the Dirty Frag vulnerability (CVE-2026-43284), meaning that a system already updated against Dirty Frag remains exposed. A Linux support vendor reproduced the bug up to root access on AlmaLinux 8, 9 and 10, Debian 12 and 13 and Ubuntu 24.04 and 26.04. Kernel developers had already received an independent report on the same issue the previous week, and on October 22 a two-line patch was published and reviewed, in copy to stable branches but not yet integrated. ZDI-CAN-34068 is an out-of-bounds write in VMware’s virtual graphics driver, vmwgfx, with CVSS 8.8; ZDI-CAN-34076 is an information exposure in the NVMe target driver, nvmet, with CVSS 8.6. Only titles are available for both.
Until KSMBD has a patch integrated into mainline, concrete mitigation measures for those managing SMB shares on Linux include disabling the module when not necessary, limiting access to port 445 to trusted networks and avoiding enabling SMB Direct on systems that do not use RDMA interfaces.
Source and further reading on KSMBD vulnerabilities: original article.
* Content created with the assistance of artificial intelligence systems.