Unpatched Linux KSMBD flaws disclosed, including two remote code execution bugs
Neither CVSS 9.0 KSMBD issue had a CVE or a mainline fix as of October 23, 2026.
74
- Mentions · 7d4
- Mentions · 30d4
- All mentions4
- First seenOct 22, 2026
- Last mentioned2d ago
Timeline
4 articles · newest firstUnpatched Linux KSMBD flaws rated CVSS 9.0 posted before fixes
ZDI reports describe remote code execution in the kernel SMB server; no CVE or mainline fix is named.
76
Two unfixed Linux KSMBD flaws allow remote code execution, CVSS 9.0
One flaw needs no authentication on port 445; neither has a CVE or a confirmed mainline fix.
78
pwn.watch lists GitLab RCE, leaked kernel bugs and LiteLLM compromise
The same live feed also covers BIND GSS-TSIG memory corruption, Node.js security releases, bank AI-agent logins and a Railway environment-variable incident.
68
Related CVEs
by mentions- CVE-2026-110264<1%10.0Unauthenticated RCE in GitLab CE/EE via regex integer overflow
- CVE-2026-11149733%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-94300<1%8.1GSS-TSIG UDP replay memory corruption in BIND 9 named
- CVE-2026-105482<1%7.4NUL-byte truncation in Node.js dns.resolve* and dns.reverse
- TLS hostname check bypass in Node.js 24.x and 26.x
- TLS hostname mismatch in Node.js for leading-zero IPv4
Appears with
- Zero Day Initiativeorganization · 4
- Linux kernelproduct · 3
- ConnManproduct · 3
- Trend Microorganization · 3
- LiteLLMvendor · 1
- Wells Fargovictim · 1
- nvmetproduct · 1
- VMwarevendor · 1
- GitLabvendor · 1
- linux-nextproduct · 1
- vmwgfxproduct · 1
- GitLab CE/EEproduct · 1
- Morgan Stanleyvictim · 1
- Node.jsvendor · 1
- ISCvendor · 1
- JPMorgan Chasevictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.