TREND Micro’s Zero Day Initiative (ZDI) has published details of several unpatched Linux kernel vulnerabilities to the public Linux kernel mailing list (LKML) as of 22 October 2026. The disclosures include two KSMBD flaws rated at CVSS 9.0 that can enable remote code execution, with patches still moving through kernel development branches. The article notes that none of these flaws has a CVE ID yet and that mainline kernel versions remain unpatched for now.
The public posts describe root causes and attack conditions in detail, including a demonstrated attack chain for a networking bug. In particular, ZDI-CAN-33774 (CVSS 9.0) involves a race condition in how KSMBD assigns its handler table, exposing any server running KSMBD on port 445 without authentication.
ZDI-CAN-33549 (CVSS 9.0) concerns an integer underflow in SMB Direct, where crafted RDMA buffer descriptors can cause a size counter wrap and a memory copy overrun, requiring RDMA support and a writable KSMBD share. Additional items include ZDI-CAN-33367, describing a skb_zerocopy() issue that lets an unprivileged process alter page-cache data; ZDI-CAN-34068 and ZDI-CAN-34076 involving an out-of-bounds write in the VMware VMWGFX driver and an uninitialised resource in NVMET, respectively. Exploitation in the wild has not been observed.
Mitigation remains practical and precautionary: disable KSMBD if not needed or block port 445 from untrusted networks, turn off SMB Direct where RDMA is unnecessary, and monitor distribution kernel updates. A patch for SMB Direct is in a Linux 7.5 branch, with a skb_zerocopy fix anticipated.