Two Linux KSMBD remote-code-execution reports land on a public mailing list before released fixes
ZDI posted ZDI-CAN-33774, a KSMBD dispatch race, and ZDI-CAN-33549, an SMB Direct integer underflow, to public LKML with technical details. Both are rated CVSS 9.0. Fixes exist only in development trees; no released kernel fix is verified.
- Disclosed
- Oct 21, 2026
- Updated Oct 22, 2026
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Systems serving SMB through kernel KSMBD; the race needs a guest share, the SMB Direct bug an RDMA device and writable share
- linux
- In the wild
- Unknown
- No attacks reported; the public reports include enough detail to reproduce the bugs
What happened
L3: reported RCE in an optional in-kernel SMB server, with technical details on a public list. Both reports were tested against 7.3-rc3. The dispatch race lets an SMB1 buffer be handled as SMB2, leaking heap memory, with a reported path to an out-of-bounds write; it needs a guest share. The SMB Direct underflow needs an RDMA device, a writable share and SMB Direct. Most Linux machines don’t run KSMBD at all.
The KSMBD maintainer says the dispatch race is already fixed in the ksmbd development tree. The SMB Direct developer only expects a development branch already fixes the other one. Neither has reached a released kernel we could verify, so no safe kernel version is listed. No working exploit or exploitation has been reported.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| KSMBD dispatch race (ZDI-CAN-33774) | unknown | Maintainer says fixed in the ksmbd development tree (commit 68f410faedaf); no released kernel verified |
| SMB Direct underflow (ZDI-CAN-33549) | unknown | Developer expects a for-7.5 development branch already fixes it; unconfirmed |
Crime-scene timeline
Oct 21, 21:16 UTC
ZDI posts ZDI-CAN-33549 to public LKML
The SMB Direct report, tested on 7.3-rc3, includes the vulnerable code path and target requirements.
Oct 21, 21:36 UTC
ZDI posts ZDI-CAN-33774 to public LKML
The dispatch race report includes analysis and a KASAN trace.
Oct 21, 22:16 UTC
SMB Direct developer asks for a retest on a development branch
Oct 22, 2026
KSMBD maintainer points to an existing fix for the dispatch race
Greg Kroah-Hartman separately objects to unpatched reports on a public list.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- ZDI-CAN-33774 report on LKMLPrimaryCVSS 9.0 KSMBD dispatch race tested on 7.3-rc3; OOB read leaks heap memory, path to OOB write; requires race and guest share
- ZDI-CAN-33549 report on LKMLPrimaryCVSS 9.0 integer underflow in smbdirect_connection_rdma_xmit(); needs an RDMA device, writable share and SMB Direct
- KSMBD maintainer reply (MARC archive)PrimaryNamjae Jeon says ZDI-CAN-33774 is already fixed by commit 68f410faedaf in the ksmbd tree
- SMB Direct developer reply (MARC archive)PrimaryStefan Metzmacher asks the reporter to retest on the for-7.5/smbdirect branch and guesses it is already fixed
- PhoronixZDI reports posted to public lists before mainline fixes, alongside other ZDI kernel reports
- The Hacker NewsNo named mainline or linux-next fix for either flaw at reporting