Unpatched Linux KSMBD flaws rated CVSS 9.0 posted before fixes
Original title: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List
ZDI reports describe remote code execution in the kernel SMB server; no CVE or mainline fix is named.
Trend Micro’s Zero Day Initiative posted several unpatched Linux-related flaw reports to public lists in October before fixes were ready. Two CVSS 9.0 issues, ZDI-CAN-33774 and ZDI-CAN-33549, could allow remote code execution through the optional KSMBD server, not Samba by itself. Other reports cover local privilege escalation, information disclosure, and a separate ConnMan flaw. No CVE had been assigned, and neither critical issue had a named mainline fix.
Unconfirmed: It is unclear whether the public posting was a mistake; exploitation is not reported.
- ZDI-CAN-33774 is a KSMBD race condition; ZDI-CAN-33549 is an SMB Direct integer underflow.
- A reported fix sat in a branch intended for Linux 7.5, not released kernels.
- ZDI-CAN-32005 is a ConnMan stack-buffer overflow, not a kernel flaw.
- Greg Kroah-Hartman questioned submissions sent without patches.
- ZDI had not explained the routing as of October 23, 2026.
Impact: Remote code execution via optional KSMBD, plus local privilege escalation
| Product | Affected |
|---|---|
| Linux kernel KSMBD | — |
| ConnMan | — |
- 1.Check whether KSMBD is enabled and disable it if it is not required.
- 2.Keep needed file-sharing services off untrusted networks and review share access.
- 3.Follow the Linux distribution’s notices and install vendor-approved patches when released.
- Products
- Linux kernelKSMBDConnMan
- Organizations
- Trend MicroZero Day Initiative
From the original article
3 min read at cybersecuritynews.com
Several unpatched Linux-related security flaws were posted to public mailing lists in October, exposing technical details before fixes were ready. The reports, submitted by Trend Micro’s Zero Day Initiative (ZDI), include two critical flaws rated CVSS 9. 0 that could let a remote attacker run code on systems using the Linux kernel’s KSMBD file server.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.