Two CVSS 9.0 KSMBD Flaws Expose Linux SMB Servers to Pre-Auth RCE

Linux administrators running KSMBD — the SMB server built directly into the kernel — are facing an uncomfortable situation: two remote code execution vulnerabilities rated 9.0 on the CVSS scale have been disclosed on public mailing lists, and no fix exists in the mainline kernel yet. The flaws were reported through Trend Micro's Zero Day Initiative (ZDI), which assigned the identifiers ZDI-CAN-33774 and ZDI-CAN-33549.

What Is KSMBD and Why It Matters

KSMBD is an in-kernel implementation of the SMB3 protocol, introduced to give Linux file servers a faster, more tightly integrated alternative to user-space Samba deployments. Because it runs inside the kernel, any memory-corruption bug in its parsing logic carries severe consequences — a successful exploit can mean full system compromise rather than the contained damage typical of a user-space service crash.

The Two Vulnerabilities

ZDI-CAN-33774 is the more alarming of the pair. According to the disclosure, it can be triggered before any network authentication takes place. In practical terms, that means an unauthenticated attacker who can reach the SMB service over the network may be able to achieve remote code execution without valid credentials — a pre-auth RCE, the highest-risk category of server-side flaw.

ZDI-CAN-33549 carries the same 9.0 severity rating but is narrower in scope. It requires the SMB Direct transport and an RDMA-capable network fabric. SMB Direct (SMB over RDMA) is typically found in high-performance storage and cluster environments rather than general-purpose file servers, which somewhat limits the pool of exposed systems — though those that do use it tend to be business-critical.

Disclosure Before Patch: A Familiar Tension

The most troubling aspect of this story is timing. The details surfaced on public mailing lists before the mainline kernel received fixes. That sequencing leaves defenders in the worst possible position: the technical details needed to reverse-engineer an exploit are circulating, but the official patch is not yet available for deployment.

This pattern — public disclosure outpacing vendor remediation — has become a recurring theme in open-source security. Mailing-list discussion is essential to how kernel development works, but when vulnerability specifics land in public archives ahead of a merged fix, the window between "theoretically exploitable" and "actively exploited" narrows sharply.

Assessing Your Exposure

Not every Linux system is affected. Exposure depends on whether KSMBD is running and reachable:

  • Check whether KSMBD is active. Confirm whether the ksmbd module is loaded and the service is listening on TCP port 445.
  • Review network reachability. KSMBD exposed to the internet or to untrusted network segments represents the highest risk. Internal-only deployments are lower risk but not immune to lateral movement.
  • Audit SMB Direct usage. Systems using RDMA-based SMB Direct should be treated as in-scope for ZDI-CAN-33549.
  • Consider disabling KSMBD where it is not strictly required. If Samba can serve the same role, removing the in-kernel attack surface is a reasonable interim mitigation.

Interim Mitigations

Until kernel patches land, defenders should lean on compensating controls:

  1. Restrict SMB access with firewall rules and network segmentation so that only known, trusted hosts can reach port 445.
  2. Disable KSMBD on systems that do not need it, or fall back to a user-space SMB implementation.
  3. Monitor for anomalous SMB traffic, particularly malformed negotiation requests or unexpected connection bursts targeting KSMBD hosts.
  4. Track kernel updates closely and be prepared to patch rapidly once fixes are merged into mainline and backported to stable and distribution kernels.

The Bigger Picture

KSMBD's position inside the kernel makes it an attractive target, and its relatively young codebase compared with Samba means hardening is still ongoing. The pre-auth nature of ZDI-CAN-33774, combined with premature public disclosure, makes this a priority item for anyone running Linux file servers. Organizations should verify their KSMBD exposure now rather than waiting for the patch cycle to complete.

For the original reporting, see The Hacker News.

Note: As of publication, no CVE identifiers had been assigned to these ZDI cases, and no mainline kernel fix was available. Administrators should monitor ZDI advisories and kernel stable releases for updates.