Two Critical CVSS 9.0 Remote Code Execution Flaws Disclosed in Linux KSMBD

Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.

One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network. Both vulnerabilities were disclosed on public mailing lists before kernel fixes were available, as reported by The Hacker News.

ZDI-CAN-33774 is particularly concerning as it can be exploited without network authentication, potentially allowing an attacker to execute arbitrary code on affected Linux systems. ZDI-CAN-33549 adds a secondary attack vector for systems configured with SMB Direct and RDMA-capable networks.

As of the disclosure date, no mainline kernel patch has been released. The Linux kernel maintainers and Trend Micro ZDI are likely coordinating remediation, but systems remain vulnerable until patches are applied. Mitigation recommendations include disabling the KSMBD module if SMB functionality is not required, or restricting network access to RDMA-capable interfaces for systems using SMB Direct.