Linux servers running the kernel's built-in SMB server, KSMBD, are exposed to two remotely exploitable vulnerabilities rated 9.0 by Trend Micro's Zero Day Initiative, with no fixes yet in the mainline kernel.
The vulnerability or weakness
The vulnerabilities, ZDI-CAN-33774 and ZDI-CAN-33549, allow for remote code execution. ZDI-CAN-33774 can be triggered without network authentication, while ZDI-CAN-33549 requires an RDMA-capable network interface.
Earlier attacks and coverage
- Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed (2026-10-22)
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases (2026-10-21)
- Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor (2026-10-19)
Business impact
Organizations using Linux servers with KSMBD are at risk of unauthorized code execution, potentially leading to data breaches and operational disruptions.
Industries affected
The incident affects organizations in various sectors, including enterprises, cloud providers, and any that rely on Linux servers for file sharing.
Users affected
Customers and users of Linux servers with KSMBD may have their systems compromised, leading to potential data loss and system instability.
