Two Critical RCE Vulnerabilities Discovered in KSMBD

Linux servers utilizing KSMBD, the kernel's integrated SMB server, are affected by two newly discovered vulnerabilities. These vulnerabilities, classified as CVSS 9.0 by Trend Micro's Zero Day Initiative, allow for remote code execution (RCE). The security flaws were announced on public mailing lists before a patch could be made available in the main kernel. The first vulnerability, identified as ZDI-CAN-33774, can be exploited without prior network authentication. This means that attackers could potentially gain immediate access to affected systems, increasing the urgency for a patch.

The second vulnerability, ZDI-CAN-33549, requires the use of SMB Direct transport and an RDMA-capable network environment, although this does not significantly reduce the attack surface. The discovery of these vulnerabilities has raised concerns within the IT security community. Experts warn that the combination of a high CVSS score and the ability to exploit the first vulnerability without authentication poses a significant risk to organizations using KSMBD in their infrastructures. So far, there is no official fix for these vulnerabilities in the main kernel. The flaws were disclosed at a time when many companies rely on Linux-based servers to manage and store their data.

The use of KSMBD is widespread in many modern Linux distributions, significantly increasing the potential number of affected systems. Security researchers advise reviewing the use of KSMBD and considering alternative solutions if necessary. The Zero Day Initiative has repeatedly emphasized the importance of timely security updates. The discovery of these vulnerabilities could accelerate discussions about the need for faster implementation of security updates. Companies dependent on KSMBD should review their security policies and ensure they have appropriate risk mitigation measures in place.

The disclosure of the vulnerabilities has also drawn the attention of developers and system administrators who may need to adjust their systems to minimize risks. The need for rapid identification and remediation of security flaws is seen as critical to maintaining the integrity of IT infrastructures. The vulnerabilities have been discussed in various forums and social media in recent days, with many experts expressing concern about the potential impact on businesses. Discussions are focusing on the necessity of taking proactive measures to protect systems from possible attacks. The Zero Day Initiative has stressed that the discovery of these vulnerabilities represents not only a technical issue but also a challenge for the entire industry.

The need for quick remediation of security flaws and improved communication between developers and users is considered essential to ensure the security of Linux servers. The vulnerabilities ZDI-CAN-33774 and ZDI-CAN-33549 are another example of the challenges faced by the IT security community. The discovery of such vulnerabilities requires a swift response and close collaboration between developers, security researchers, and businesses to minimize risks. The exact number of affected systems is currently unknown. The vulnerabilities were made public on October 23, 2026, and discussions about possible solutions and patches have already begun.