Two Critical Linux KSMBD Vulnerabilities Could Enable Remote Code Execution

Two publicly disclosed vulnerabilities in KSMBD, the Linux kernel's built-in SMB server, could allow attackers to execute code remotely on vulnerable systems. Both flaws have been assigned a severity score of CVSS 9.0 by Trend Micro's Zero Day Initiative (ZDI), and neither had a confirmed fix in the mainline Linux kernel at the time of reporting.

One vulnerability can reportedly be triggered without authentication, potentially exposing systems running KSMBD with the SMB service accessible over the network. The second affects the SMB Direct transport and requires an RDMA-capable network interface, making its exploitation dependent on additional configuration.

The vulnerabilities are tracked as ZDI-CAN-33774 and ZDI-CAN-33549. Neither had received a CVE identifier at the time of disclosure.

ZDI-CAN-33774: Unauthenticated Remote Code Execution

The more broadly applicable vulnerability, ZDI-CAN-33774, affects KSMBD's handling of SMB protocol messages. According to the disclosure, an attacker does not need a valid account to trigger the issue.

The flaw involves a race condition in how KSMBD assigns its request-handler table. By sending a burst of short SMB1 packets followed by an SMB2 packet within the same TCP write, an attacker can cause worker threads to process SMB1 data using an SMB2 handler.

This mismatch can lead to an out-of-bounds read because the handler processes data beyond the end of the shorter buffer. The report also describes a path to an out-of-bounds write when an attacker has access to an SMB share.

Because the vulnerability can be triggered before authentication, systems running KSMBD with port 445 reachable over a network may be exposed. The actual impact depends on the server configuration and the ability to reach the affected service.

ZDI-CAN-33549: Integer Underflow in SMB Direct

The second vulnerability, ZDI-CAN-33549, affects KSMBD's SMB Direct implementation and involves an integer underflow that can lead to a memory-copy operation overrunning an allocated buffer.

An attacker can supply RDMA buffer descriptors in which the first buffer is longer than the declared payload. This causes the server's size counter to wrap, potentially allowing a subsequent memory copy to extend beyond the allocated memory region.

Exploitation requires several conditions:

  • An RDMA-capable network interface, either physical hardware or the software-based rxe driver.
  • A writable KSMBD share.
  • A client that negotiates SMB Direct.

These requirements make the attack more configuration-dependent than ZDI-CAN-33774, which does not require authentication according to the disclosure.

Vulnerability Overview

ZDI identifierAffected componentReported flawCVSSKey requirementZDI-CAN-33774KSMBD protocol dispatchRace condition and out-of-bounds memory access9.0Network access to KSMBD; authentication not requiredZDI-CAN-33549KSMBD SMB DirectInteger underflow leading to buffer overrun9.0SMB Direct, RDMA capability, and writable share

No Confirmed Mainline Kernel Fix Yet

At the time of reporting, neither vulnerability had a named fix in the mainline Linux kernel or the linux-next integration tree.

Linux kernel news outlet Phoronix reported that SMB Direct maintainer Stefan Metzmacher had submitted a proposed fix for ZDI-CAN-33549 targeting the next kernel development cycle. That report had not been independently confirmed in the supplied disclosure.

Even after a fix enters the mainline kernel, it can take additional time to reach stable kernel branches and Linux distribution packages. Administrators should monitor upstream kernel discussions and their distribution's security advisories for confirmed fixes.

The absence of CVE identifiers is also notable. According to the Linux kernel's vulnerability-handling documentation, CVE identifiers are assigned after a fix becomes available in a stable kernel tree.

How to Check Whether KSMBD Is Running

Linux administrators can check the service status and loaded kernel module using the following commands:

systemctl status ksmbd
lsmod | grep ksmbd

The first command checks the systemd service status, while the second looks for a loaded KSMBD module. Depending on the distribution and how KSMBD is configured, the service or module may not be present.

Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat support documentation. However, administrators should verify their actual systems rather than assuming that a distribution is unaffected.

Until a confirmed fix is available, organizations should reduce exposure to the affected SMB service.

  • Disable KSMBD if it is not required. Avoid running an SMB server unnecessarily.
  • Restrict network access to port 445. Permit SMB connections only from trusted networks and authorized clients.
  • Review SMB Direct configuration. Determine whether RDMA interfaces and SMB Direct are enabled, particularly on systems with writable KSMBD shares.
  • Monitor for suspicious activity. Review system logs, unexpected SMB connections, and abnormal server behavior.
  • Prepare for patch deployment. Track kernel and distribution security advisories and apply a verified fix as soon as it becomes available.

These measures reduce exposure but should not be treated as a substitute for a security update.

Disclosure Process Raises Questions

The vulnerabilities were reported through Trend Micro's Zero Day Initiative, which credited its TrendAI scanning technology with discovering the issues.

The disclosures were sent to public Linux kernel mailing lists alongside the private kernel security address, but the reports did not include patches. Stable-kernel maintainer Greg Kroah-Hartman criticized this submission approach in responses to separate vulnerability reports involving other kernel components.

The supplied disclosure also identifies three additional kernel reports that do not affect KSMBD:

  • ZDI-CAN-33367: A local privilege-escalation vulnerability in the networking stack involving skb_zerocopy.
  • ZDI-CAN-34068: A local privilege-escalation issue in the VMware virtual GPU driver.
  • ZDI-CAN-34076: An information-disclosure issue in the NVMe target driver.

A separate report, ZDI-CAN-32005, concerns a buffer overflow in ConnMan, a network daemon rather than a Linux kernel component.

These issues should not be confused with the two KSMBD remote code execution vulnerabilities.

What Linux Administrators Should Know

The two KSMBD vulnerabilities highlight the risks of exposing kernel-level file-sharing services to untrusted networks. ZDI-CAN-33774 is particularly concerning because the reported attack does not require authentication, while ZDI-CAN-33549 presents additional risk to systems using SMB Direct and RDMA.

Administrators should identify systems running KSMBD, restrict access to the service, disable it where unnecessary, and monitor for official kernel fixes. Until patched versions are confirmed, limiting network exposure is the most important immediate precaution.