Trend Micro’s Zero Day Initiative published two remote code execution defects in KSMBD, the SMB server built into the Linux kernel, on open mailing lists this week. Both are rated 9.0 and neither had a mainline fix.
ZDI-CAN-33774 is the more serious. It needs no authentication and reaches any host running KSMBD on port 445. The bug is a race in how the module assigns handlers: a burst of short SMB1 packets followed by an SMB2 packet in one TCP write leaves a worker processing SMB1 data with an SMB2 handler, reading past the buffer. A path to writing past it opens once an attacker has share access.
ZDI-CAN-33549 requires SMB Direct and an RDMA interface. A client can list buffer descriptors where the first is longer than the declared payload, wrapping the size counter so a later copy overruns memory.
No identifier to track them by
Neither flaw has a CVE. The kernel project issues identifiers only after a stable-tree fix lands, and nothing has landed yet. SMB Direct maintainer Stefan Metzmacher has reportedly submitted a patch for one, aimed at the next development cycle – fixes typically take weeks more to reach distribution kernels.
When AI writes the report
The reports credit TrendAI, Trend Micro’s AI scanner. Kernel documentation updated in May 2026 states that bugs found by AI tools are already public by definition and belong on subsystem lists. ZDI followed that logic, copying public lists and attaching no patches.
Greg Kroah-Hartman’s replies were blunt, objecting to public disclosure without patches.
What to check today
Run lsmod | grep ksmbd or systemctl status ksmbd. If the module loads, firewalling port 445 to known clients is the only control available until a kernel lands. Red Hat Enterprise Linux does not ship KSMBD by default.
