Unpatched Linux KSMBD flaws disclosed, including two remote code execution bugs
Original title: Critical Unpatched Linux Kernel Vulnerabilities Accidentally Disclosed, Including Two Remote Code Execution Flaws
Neither CVSS 9.0 KSMBD issue had a CVE or a mainline fix as of October 23, 2026.
In October, Trend Micro’s Zero Day Initiative reports on unpatched Linux flaws appeared on public mailing lists before fixes were widely available. Two CVSS 9.0 issues in optional KSMBD could allow remote code execution; other reports describe local privilege escalation and information exposure. A fix for one KSMBD bug is reportedly in a development branch aimed at Linux 7.5, not confirmed in released kernels. Greg Kroah-Hartman questioned the unpatched publication; whether it was accidental is unconfirmed.
Unconfirmed: It is unconfirmed whether the mailing-list disclosures were accidental, and ZDI had not clarified its decisions.
- ZDI-CAN-33774 is a KSMBD race condition that can cause out-of-bounds access.
- ZDI-CAN-33549 is an integer underflow in KSMBD’s SMB Direct implementation.
- Samba-only systems are not automatically affected because KSMBD is separate.
- ConnMan, named in ZDI-CAN-32005, is a user-space service, not a kernel component.
- ZDI had not publicly clarified its submission decisions as of October 23, 2026.
Impact: remote code execution or local privilege escalation
| Product | Affected |
|---|---|
| Linux KSMBD | — |
- 1.Check whether KSMBD is enabled and disable it if unused.
- 2.If KSMBD is required, restrict it to trusted networks and review shares.
- 3.Apply vendor-approved distribution updates rather than assuming upstream fixes are deployed.
- Products
- Linux kernelKSMBDConnMan
- Organizations
- Zero Day InitiativeTrend Micro
From the original article
2 min read at gbhackers.com
In October, several unpatched Linux vulnerabilities were disclosed on public mailing lists, revealing technical details before fixes were widely available. These disclosures included two critical flaws in KSMBD that could let remote attackers execute code, along with reports of privilege escalation and information disclosure. Trend Micro’s Zero Day Initiative (ZDI) submitted the reports, prompting Linux […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.