Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

ZDI posted unpatched Linux KSMBD flaws on a public list

5 sources · 5 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Two unpatched CVSS 9.0 Linux KSMBD remote code execution reports are public, with no CVEs or confirmed mainline fixes.

Trend Micro’s Zero Day Initiative sent reports of unpatched Linux issues to a public kernel mailing list rather than the private security list. Two are rated CVSS 9.0 and concern the optional KSMBD server, not Samba: ZDI-CAN-33774, an unauthenticated race on port 445, and ZDI-CAN-33549, an SMB Direct integer underflow that needs RDMA and a writable share. Neither has a CVE or a confirmed mainline or linux-next fix; the kernel assigns CVEs only after a stable-tree fix. A reported fix sits in a branch aimed at Linux 7.5, and Phoronix said Stefan Metzmacher submitted a fix for a later cycle. Other public reports cover local privilege escalation or information disclosure, plus a separate ConnMan issue.

Key facts
  • ZDI-CAN-33774 is a pre-authentication KSMBD race on port 445, CVSS 9.0.
  • ZDI-CAN-33549 needs SMB Direct, RDMA, and a writable KSMBD share.
  • Red Hat Enterprise Linux does not ship KSMBD by default.
  • Greg Kroah-Hartman questioned submissions sent without patches.
  • Hacker News lists ZDI-CAN-32005 as local privilege escalation; Cyber Security News and GBHackers call it a ConnMan user-space overflow.
Analyze CVE-2026-99999 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 23, 2026ZDI still had not explained the public routing. · Cyber Security News

What each outlet adds

beyond the shared facts
  • Hacker NewsNames the ZDI-CAN IDs, CVSS 9.0 scores, and a Linux 7.5 branch.
  • The Hacker NewsGives exploit preconditions, RHEL default, and CVE-after-fix policy.
  • Cyber Security NewsSays ZDI had not explained the routing by October 23.
  • GBHackersSays whether disclosure was accidental remains unconfirmed.
CVEs
CVE-2026-99999
Vendors
Red HatAmazon Web ServicesLinuxTrend MicroVMware
Products
Linux kernelKVMFirecrackerOpenShift Container Platformvirtio-netKSMBDlinux-nextConnManvmwgfxnvmet
Organizations
Pwn.aiVercelZero Day InitiativeTrend MicroLinux kernel mailing list

Coverage

oldest first · one row per article · UTC
  1. · 5d ago CSO OnlineFirst report

    Linux networking flaw lets KVM guests escape to the host

    Pwn.ai leaked host memory on Vercel production sandboxes and gained root on lab hosts; guest-only updates do not fix it.

  2. · 3d ago Hacker News · security

    Unpatched Linux kernel flaws posted to the public LKML

    Trend Micro ZDI reports include two CVSS 9.0 remote code execution issues; mainline fixes are not out, though some patches are in testing.

  3. · 3d ago The Hacker News

    Two unfixed Linux KSMBD flaws allow remote code execution, CVSS 9.0

    One flaw needs no authentication on port 445; neither has a CVE or a confirmed mainline fix.

  4. · 2d ago Cyber Security News

    Unpatched Linux KSMBD flaws rated CVSS 9.0 posted before fixes

    ZDI reports describe remote code execution in the kernel SMB server; no CVE or mainline fix is named.

  5. · 2d ago GBHackers

    Unpatched Linux KSMBD flaws disclosed, including two remote code execution bugs

    Neither CVSS 9.0 KSMBD issue had a CVE or a mainline fix as of October 23, 2026.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-99999
Linux kernel IPv4 checksum metadata can corrupt headers
9.3<1%PoC ×10