Linux KSMBD Servers Face Two Publicly Disclosed RCE Flaws Without a Mainline Fix
Linux servers running KSMBD, the kernel’s built-in SMB server, are exposed to two publicly reported remote-code-execution flaws rated 9.0 by Trend Micro’s Zero Day Initiative. The mainline kernel does not yet contain a fix, leaving organizations that actively use KSMBD with a need to establish whether the module is enabled and understand which network paths are exposed.
The more broadly exposed issue is ZDI-CAN-33774. It requires no authentication and affects a KSMBD server reachable on port 445. The report describes a race involving short SMB1 packets followed by an SMB2 packet in the same TCP write; workers can then process SMB1 data with an SMB2 handler and read beyond the shorter buffer. The same report also describes a path to writing beyond the buffer once an attacker has access to a share.
The second flaw, ZDI-CAN-33549, affects KSMBD’s SMB Direct path rather than every KSMBD deployment. Exploitation requires an RDMA-capable network interface, a writable KSMBD share, and a client that negotiates SMB Direct. The evidence specifically identifies the rxe software driver as one possible RDMA interface and describes an integer underflow that can allow a memory copy to overrun an allocated buffer.
For administrators, the immediate question is whether KSMBD is running. The supplied reporting gives two local checks: systemctl status ksmbd and lsmod | grep ksmbd. A positive result does not establish that a server is exploitable, but it identifies systems that need review of port 445 exposure, SMB shares, SMB Direct negotiation and RDMA configuration.
There is not yet a named fix in the mainline kernel or in linux-next, the integration tree that feeds it. The report says a fix for ZDI-CAN-33549 was submitted for the next kernel development cycle, but also notes that this was not confirmed elsewhere. Fixes normally take time to move from mainline into stable branches and then distribution kernels, so administrators should monitor their distribution’s security channels rather than assume that a downstream package is already available.
The flaws do not have CVE identifiers because the kernel project assigns those only after a stable-tree fix is available. That makes product and kernel-package tracking especially important for teams inventorying KSMBD: the affected component and the ZDI identifiers are currently the clearest labels in the supplied evidence.