/
← Voltar ao feed
high

Two unpatched CVSS 9.0 Linux KSMBD RCE flaws (ZDI-CAN-33774, ZDI-CAN-33549) disclosed publicly by ZDI without mainline fixes

2 fonte(s) · 2 atualização(ões) · publicado 22/10/2026 14:01 · coletado há 23 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 24/10/2026 00:02; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ thehackernews.com ↗

Trend Micro's Zero Day Initiative (ZDI) reports on two remote code execution flaws in KSMBD, the Linux kernel's in-kernel SMB server, each rated CVSS 9.0, appeared on public kernel mailing lists in October 2026 without patches (thehackernews.com, gbhackers.com). As of 22-23 October 2026, neither ZDI-CAN-33774 nor ZDI-CAN-33549 has a fix in the mainline kernel or linux-next, and neither has a CVE identifier (thehackernews.com, gbhackers.com). ZDI-CAN-33774 can be triggered before authentication on port 445, while ZDI-CAN-33549 requires the SMB Direct transport and an RDMA-capable interface (thehackernews.com). Both were credited to TrendAI, Trend Micro's AI scanner. Stable-kernel maintainer Greg Kroah-Hartman criticized publication without patches, and it remains unconfirmed whether the disclosures were accidental; ZDI had not publicly clarified its decisions as of 23 October (gbhackers.com). Neither source reports exploitation in the wild. The same ZDI batch includes several unrelated bugs that do not affect KSMBD servers.

Entenda a falha

A vulnerabilidade

Two CVSS 9.0 remote code execution flaws affect KSMBD, the Linux kernel's in-kernel SMB server (not Samba). ZDI-CAN-33774 can be triggered before authentication on port 445: a race in how KSMBD assigns its handler table makes SMB1 data be processed with an SMB2 handler, causing an out-of-bounds read, with a write path once the attacker has share access. ZDI-CAN-33549 is an integer underflow in the SMB Direct path; it needs an RDMA-capable interface, a writable KSMBD share and a client negotiating SMB Direct. Neither has a CVE or a mainline fix; the articles give no affected version ranges. Other unpatched ZDI reports do not affect KSMBD servers.

Como funciona

For ZDI-CAN-33774, KSMBD workers receive SMB packets over TCP port 445 and pick a handler table for each. When a burst of short SMB1 packets is followed by an SMB2 packet in the same TCP write, the handler assignment races, and a worker ends up processing SMB1 data with the SMB2 handler, reading beyond the end of the shorter buffer. For ZDI-CAN-33549, a client negotiating SMB Direct sends RDMA buffer descriptors where the first is longer than the declared payload. The server's size counter wraps (underflows), and a later memory copy runs past the end of the allocated buffer.

Por que é vulnerável

ZDI-CAN-33774 is a race condition in how the handler table is assigned for queued network requests, so the handler does not match the data being parsed, leading to out-of-bounds memory access. ZDI-CAN-33549 is an integer underflow: the descriptor length is not validated against the declared payload, so the counter wraps and a later copy trusts a wrong size. The articles do not say why they went unnoticed. For the fix, they only say that a fix for ZDI-CAN-33549 was reportedly submitted by SMB Direct maintainer Stefan Metzmacher (per Phoronix, via The Hacker News) or sits in a development branch targeting Linux 7.5 (per gbhackers); this is unconfirmed.

Como foi descoberta

Both reports credit TrendAI, Trend Micro's AI scanner, as the finder, and Trend Micro's Zero Day Initiative submitted them in October 2026 to public kernel mailing lists, also copying the private kernel security address, with no patches. The kernel security documentation, updated in May 2026 after guidance from Linus Torvalds, says AI-found bugs are already public and should go to subsystem lists, which ZDI's routing appeared to follow. Greg Kroah-Hartman criticized sending reports publicly without patches; whether it was accidental is unconfirmed, and ZDI had not explained as of 23 October. No exploitation in the wild is reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 24/10/2026 00:17.

Detalhes técnicos

  • ZDI-CAN-33774 (CVSS 9.0): an unauthenticated race in how KSMBD assigns its handler table. A burst of short SMB1 packets followed by an SMB2 packet in the same TCP write makes workers process SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. A write-past-buffer path also exists once an attacker has share access (thehackernews.com). gbhackers.com describes it more generally as a race in queued network request handling leading to out-of-bounds memory access and potential RCE.
  • ZDI-CAN-33549 (CVSS 9.0): an integer underflow in the KSMBD SMB Direct path. A client supplies RDMA buffer descriptors in which the first is longer than the declared payload; the size counter wraps and a later memory copy overruns an allocated buffer. Exploitation needs an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share and a client negotiating SMB Direct (thehackernews.com). Exposure depends on configuration and whether SMB Direct is enabled (gbhackers.com).
  • KSMBD is distinct from Samba, so systems running only Samba are not automatically affected (gbhackers.com).
  • Other reports in the same ZDI batch, not affecting KSMBD servers: ZDI-CAN-33367 (local privilege escalation in networking code, skb_zerocopy; found by researcher p1r0x per thehackernews.com; developers reportedly received an earlier independent report and are working on a patch per gbhackers.com); ZDI-CAN-34068 (local privilege escalation, out-of-bounds write in the VMware virtual GPU driver); ZDI-CAN-34076 (information disclosure, uninitialized resource in the NVMe over Fabrics target driver); ZDI-CAN-32005 (stack-buffer overflow in ConnMan search-domain TCP query handling; a user-space service, not the kernel).

Remediação

  • Check exposure with systemctl status ksmbd or lsmod | grep ksmbd (thehackernews.com).
  • Disable KSMBD if unused. If required, restrict port 445 and file sharing to trusted networks, review share permissions and evaluate SMB Direct exposure (gbhackers.com, thehackernews.com).
  • Red Hat Enterprise Linux does not include KSMBD by default (thehackernews.com).
  • No mainline patch exists; fixes typically take weeks to reach stable and distribution kernels. Monitor distribution advisories and apply vendor updates once available. Network restrictions are not a substitute for patches (gbhackers.com).

Relatos divergentes

  • Fix status for ZDI-CAN-33549: thehackernews.com, citing Phoronix, says SMB Direct maintainer Stefan Metzmacher submitted a fix targeting the next kernel development cycle, unconfirmed elsewhere. gbhackers.com (more recent) says a fix reportedly exists in a development branch targeting Linux 7.5, and cautions that this does not mean released kernels or distribution packages include it. Both agree there is no mainline fix yet; the fix is unverified.
  • Finder attribution: both credit Trend Micro's AI scanner; thehackernews.com names it TrendAI. gbhackers.com also says updated kernel guidance reportedly treats AI-discovered bugs as already public, which is not corroborated by thehackernews.com.

Linha do tempo

  1. gbhackers.com ↗ · pub. 23/10/2026 02:17 · coletado 23/10 03:00

    Unpatched Linux KSMBD RCE flaws and other kernel bugs disclosed publicly via ZDI reports without fixes

    ler a análise desta fonte

    In October 2026, technical details of several unpatched Linux vulnerabilities appeared on public mailing lists before fixes were widely available. The reports were submitted by Trend Micro's Zero Day Initiative (ZDI), and the most severe are two remote code execution flaws in KSMBD, the in-kernel SMB server. Kernel maintainer Greg Kroah-Hartman questioned why the issues were published without patches. It remains unconfirmed whether the disclosures were accidental. The reports credit Trend Micro's AI scanner with the discoveries, and updated kernel guidance reportedly treats AI-discovered bugs as already public. As of October 23, 2026, ZDI had not publicly clarified its submission decisions.

    Technical Details

    • ZDI-CAN-33774 (CVSS 9.0): a race condition in KSMBD's handling of queued network requests. Inconsistent request handling can cause out-of-bounds memory access and potentially remote code execution.
    • ZDI-CAN-33549 (CVSS 9.0): an integer underflow in KSMBD's SMB Direct implementation produces an incorrect length value, so later memory operations exceed buffer limits. Exposure depends on configuration and on whether SMB Direct is enabled. A fix reportedly exists in a development branch targeting Linux 7.5, but that does not guarantee that released kernels or distribution packages include it.
    • Neither critical flaw had a fix in the mainline kernel or its integration tree, and neither had a CVE assigned at the time of reporting.
    • ZDI-CAN-33367: skb_zerocopy networking code, local privilege escalation. Developers reportedly received an earlier independent report and are working on a patch.
    • ZDI-CAN-34068: out-of-bounds write in the VMware graphics driver, local privilege escalation.
    • ZDI-CAN-34076: uninitialized resource in the NVMe over Fabrics target implementation, information exposure.
    • ZDI-CAN-32005: stack-buffer overflow in ConnMan's handling of search-domain TCP queries. ConnMan is a user-space service, not a kernel component.
    • KSMBD is distinct from Samba, so systems running only Samba are not automatically affected.

    Remediation

    • Check whether KSMBD is enabled and needed. Disable it if it is unused.
    • If KSMBD is required, restrict file sharing to trusted networks, review share permissions, and evaluate SMB Direct exposure.
    • Monitor distribution security advisories rather than assuming upstream development changes have reached deployed systems.
    • Apply vendor-approved updates promptly once available. Network restrictions alone are not a substitute for patches.
  2. thehackernews.com ↗ · pub. 22/10/2026 14:01 · coletado 22/10 16:00 primeiro registro

    Two CVSS 9.0 Linux KSMBD RCE flaws (ZDI-CAN-33774, ZDI-CAN-33549) disclosed publicly with no mainline kernel fix

    ler a análise desta fonte

    Trend Micro's Zero Day Initiative (ZDI) disclosed two remote code execution flaws in KSMBD, the Linux kernel's built-in SMB server, each rated CVSS 9.0. As of Thursday neither has a named fix in the mainline kernel or linux-next, and neither has a CVE identifier yet. ZDI-CAN-33774 can be triggered before authentication on port 445. ZDI-CAN-33549 requires the SMB Direct transport and an RDMA-capable interface. ZDI credited TrendAI, Trend Micro's AI scanner, as the finder. The reports were copied to public kernel mailing lists without patches, which drew criticism from stable-kernel maintainer Greg Kroah-Hartman. The article does not report exploitation in the wild.

    Technical Details

    • ZDI-CAN-33549: an integer underflow in KSMBD's SMB Direct path. A client supplies RDMA buffer descriptors in which the first is longer than the declared payload. The size counter wraps, and a later memory copy overruns the end of an allocated buffer. Exploitation needs an RDMA-capable interface (hardware or the rxe software driver), a writable KSMBD share, and a client negotiating SMB Direct.
    • ZDI-CAN-33774: an unauthenticated race in how KSMBD assigns its handler table. A burst of short SMB1 packets followed by an SMB2 packet in the same TCP write makes workers process SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. A write-past-buffer path also exists once an attacker has access to a share.
    • Phoronix reported that SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549 targeting the next kernel development cycle. This is not confirmed elsewhere.
    • The same ZDI batch includes three unrelated kernel reports that do not affect KSMBD servers: ZDI-CAN-33367 (local privilege escalation in the networking stack, found by researcher p1r0x), ZDI-CAN-34068 (local privilege escalation in the VMware virtual GPU driver) and ZDI-CAN-34076 (information disclosure in the NVMe target driver). A sixth report, ZDI-CAN-32005, is a buffer overflow in ConnMan, which is separate from the kernel.

    Remediation

    • No patch is available in mainline. Fixes typically take weeks to reach stable branches and distribution kernels.
    • Check exposure with systemctl status ksmbd or lsmod | grep ksmbd.
    • Red Hat Enterprise Linux does not include KSMBD by default, per Red Hat's support documentation.
    • Where KSMBD is active, restrict access to port 445 until fixes ship (the article gives no explicit mitigation).