Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

ZDI posted unpatched Linux KSMBD flaws to public lists

4 sources · 4 articlesFirst reported Updated ()1
What's new

October 23: Cyber Security News and GBHackers said ZDI still had not explained the public routing, and identified ZDI-CAN-32005 as a user-space ConnMan overflow.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Unpatched Linux kernel reports, including two CVSS 9.0 KSMBD remote code execution issues, remain public with no CVEs or confirmed mainline fixes.

Trend Micro’s Zero Day Initiative posted several unpatched Linux vulnerability reports to public mailing lists in October 2026 rather than the private security list. Two optional KSMBD issues are scored CVSS 9.0 and have no assigned CVEs or confirmed mainline fixes: ZDI-CAN-33774, an unauthenticated race on port 445, and ZDI-CAN-33549, an SMB Direct integer underflow that The Hacker News says requires RDMA and a writable share. Hacker News says a patch for the underflow is in a branch aimed at Linux v7.5 and that some fixes are in testing or -next; The Hacker News says neither critical issue has a named fix in mainline or linux-next. Other reports cover local privilege escalation and an NVMe information leak. Hacker News lists ZDI-CAN-32005 as privilege escalation, while Cyber Security News and GBHackers identify it as a separate user-space ConnMan overflow. ZDI had not explained the public routing as of October 23.

Key facts
  • ZDI-CAN-33774 is an unauthenticated KSMBD race on port 445, scored CVSS 9.0.
  • ZDI-CAN-33549 is an SMB Direct integer underflow needing RDMA and a writable share.
  • The kernel project assigns CVEs only after a stable-tree fix.
  • Red Hat Enterprise Linux does not include KSMBD by default.
  • Greg Kroah-Hartman questioned public submissions sent without patches.
  • Samba-only systems are not automatically affected because KSMBD is separate.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 23, 2026ZDI had not explained why reports went public. · Cyber Security News

What each outlet adds

beyond the shared facts
  • Hacker NewsNames NVMET disclosure and a v7.5-branch patch; says some fixes are in testing.
  • The Hacker NewsDetails port 445, RDMA requirements, CVE timing, and no default RHEL KSMBD.
  • Cyber Security NewsSays ZDI had not explained the routing as of October 23.
  • GBHackersSays accidental disclosure is unconfirmed and ConnMan is user-space.
Vendors
LinuxTrend MicroRed HatVMware
Products
KSMBDlinux-nextConnManvmwgfxnvmetLinux kernel
Organizations
Zero Day InitiativeTrend MicroLinux kernel mailing list

Coverage

oldest first · one row per article · UTC
  1. · 3d ago Hacker News · securityFirst report

    Unpatched Linux kernel flaws posted to the public LKML

    Trend Micro ZDI reports include two CVSS 9.0 remote code execution issues; mainline fixes are not out, though some patches are in testing.

  2. · 3d ago The Hacker News

    Two unfixed Linux KSMBD flaws allow remote code execution, CVSS 9.0

    One flaw needs no authentication on port 445; neither has a CVE or a confirmed mainline fix.

  3. · 2d ago Cyber Security News

    Unpatched Linux KSMBD flaws rated CVSS 9.0 posted before fixes

    ZDI reports describe remote code execution in the kernel SMB server; no CVE or mainline fix is named.

  4. · 2d ago GBHackers

    Unpatched Linux KSMBD flaws disclosed, including two remote code execution bugs

    Neither CVSS 9.0 KSMBD issue had a CVE or a mainline fix as of October 23, 2026.