TWO high‑severity Linux KSMBD remote code execution flaws were disclosed publicly on mailing lists in October 2026, with no fix in the mainline kernel at the time of reporting. ZDI has assigned two identifiers to these flaws: ZDI-CAN-33549, which concerns the SMB Direct path and requires an RDMA‑capable network interface, and ZDI-CAN-33774, which affects the KSMBD protocol dispatch and can be triggered without authentication on port 445. Neither has a CVE number yet because kernel CVEs are issued only after a stable fix appears in a supported tree.
ZDI-CAN-33549 is an integer underflow in KSMBD’s SMB Direct handling. A client can supply RDMA buffer descriptors in which the first descriptor’s length exceeds the declared payload, causing the server’s size counter to wrap and enabling a subsequent memory copy to overrun the allocated buffer. This exploit requires an RDMA‑capable interface (hardware or the rxe software driver), a writable KSMBD share, and a client that negotiates SMB Direct.
ZDI-CAN-33774 involves a race in how KSMBD assigns its handler table: a burst of SMB1 packets followed by an SMB2 packet within the same TCP write can cause SMB1 data to be processed with an SMB2 handler, allowing reads past the shorter buffer and potentially writing beyond it. Both flaws are described as remote code execution vulnerabilities with a CVSS of 9.0 and affect any KSMBD installation for the first flaw, and SMB Direct‑enabled configurations for the second.
As of the report, there was no named kernel fix in mainline or linux-next, though Phoronix noted that a fix for ZDI-CAN‑33549 had been submitted targeting the next kernel development cycle. Patches and fixes are expected to take weeks to reach stable and distribution kernels. Users can verify module status via systemctl status ksmbd or lsmod | grep ksmbd, noting that Red Hat Enterprise Linux does not include KSMBD by default. The disclosure process and lack of immediate CVE assignment underscore the need for timely kernel updates once fixes are released.