Linux KSMBD Exposed to Two Unpatched Remote Code Execution Flaws
Two high-severity remote code execution bugs in the Linux KSMBD kernel module have been disclosed publicly, leaving servers without a confirmed fix in the mainline kernel.
Key points
- Trend Micro’s Zero Day Initiative rated two KSMBD flaws at 9.0, with no patch in the mainline kernel.
- One vulnerability allows pre-authentication remote code execution via a race condition.
- The second requires SMB Direct and RDMA-capable network interfaces to trigger an integer underflow.
Linux servers running the KSMBD kernel module face exposure to two remote code execution vulnerabilities. Trend Micro’s Zero Day Initiative disclosed these flaws on public mailing lists. The issues affect the kernel’s built-in SMB server. No fix has been confirmed in the mainline kernel or the linux-next integration tree as of the disclosure.
Root cause
ZDI-CAN-33774 stems from a race condition in how KSMBD assigns its handler table. A burst of short SMB1 packets followed by an SMB2 packet in the same TCP write causes workers to process SMB1 data with an SMB2 handler. This mismatch leads to reading past the end of a shorter buffer. A path to writing past the buffer also exists once an attacker has share access.
Attack path
ZDI-CAN-33549 involves an integer underflow in the SMB Direct path. A client supplies RDMA buffer descriptors where the first is longer than the declared payload. This causes the server’s size counter to wrap. The wrap allows a subsequent memory copy to overrun the end of an allocated buffer. An RDMA-capable interface is required for this exploit.
Affected versions
- Any Linux kernel with the KSMBD module active.
- Systems running on port 445 are exposed to the pre-authentication flaw.
- Systems with RDMA-capable interfaces and writable shares are exposed to the second flaw.
Mitigation
- Verify if the KSMBD module is active using systemctl status ksmbd or lsmod.
- Disable the KSMBD service if SMB functionality is not required.
- Monitor for patches in the next kernel development cycle.
- Ensure network segmentation limits access to port 445.
Detection notes
Teams usually monitor for unusual SMB traffic patterns, particularly bursts of mixed protocol versions. Check whether the KSMBD module is loaded on critical servers. Look for abnormal memory access alerts or unexpected process spawns on file servers. Verify if RDMA traffic is present on interfaces hosting SMB shares. Contain affected hosts by isolating them from the network to prevent lateral movement while awaiting vendor guidance.
Background: Network segmentation
Start by mapping your current traffic flows. Define security zones based on function, not just department. Configure firewalls to deny all traffic by default, then explicitly permit only necessary connections. Test these rules rigorously before full deployment to avoid breaking critical business applications.
Read the full guide: Network Segmentation: How to Partition and Protect Your Data
What to do and how to stay safe: Linux
- Audit your Linux servers to determine if the KSMBD module is currently active.
- Restrict network access to port 445 to trusted internal segments only.
- Disable SMB Direct and RDMA features on file servers if they are not essential.
- Watch for official kernel updates that address ZDI-CAN-33774 and ZDI-CAN-33549.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a CVE identifier for these KSMBD vulnerabilities?
No, the Linux kernel project assigns CVE identifiers only after a stable-tree fix is available.
Does Red Hat Enterprise Linux include KSMBD by default?
No, Red Hat’s support documentation states that RHEL does not include KSMBD by default.
Who discovered these vulnerabilities?
TrendAI, Trend Micro’s AI scanner, is credited as the finder of these flaws.
