Dark Web Informer :verified_paw: on Nostr: 🚨 Two critical Linux KSMBD remote code execution flaws disclosed before fixes were ...
🚨 Two critical Linux KSMBD remote code execution flaws disclosed before fixes were available
The vulnerabilities, tracked as ZDI-CAN-33774 and ZDI-CAN-33549, both carry CVSS scores of 9.0 and affect KSMBD, the Linux kernel’s built-in SMB server.
â €
ZDI-CAN-33774 can reportedly be triggered without authentication against systems running KSMBD on port 445.
ZDI-CAN-33549 affects the SMB Direct path and requires an RDMA-capable interface, a writable KSMBD share and a client using SMB Direct.
â €
Neither vulnerability currently has a CVE identifier. As of October 22, fixes had not been added to the mainline Linux kernel or linux-next.
Administrators should determine whether KSMBD is active and consider restricting network access until fixes become available.
Published at
2026-10-22 18:51:18 UTCEvent JSON
{
"id": "a08cc411647a46ccf764242a5a97c245bb1fea66883dbed2a1d0f456a0f2165f",
"pubkey": "74529fa3c8adf20d73e8e245536c5663db200537f90661d797c4fcab839459d7",
"created_at": 1792695078,
"kind": 1,
"tags": [
[
"imeta",
"url https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/486/064/612/760/057/original/255430a2eb8f2f88.png",
"m image/png"
],
[
"proxy",
"https://infosec.exchange/@DarkWebInformer/117486064669476238",
"web"
],
[
"proxy",
"https://infosec.exchange/users/DarkWebInformer/statuses/117486064669476238",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/DarkWebInformer/statuses/117486064669476238",
"pink.momostr"
],
[
"-"
]
],
"content": "🚨 Two critical Linux KSMBD remote code execution flaws disclosed before fixes were available\n\nThe vulnerabilities, tracked as ZDI-CAN-33774 and ZDI-CAN-33549, both carry CVSS scores of 9.0 and affect KSMBD, the Linux kernel’s built-in SMB server.\n⠀\nZDI-CAN-33774 can reportedly be triggered without authentication against systems running KSMBD on port 445.\n\nZDI-CAN-33549 affects the SMB Direct path and requires an RDMA-capable interface, a writable KSMBD share and a client using SMB Direct.\n⠀\nNeither vulnerability currently has a CVE identifier. As of October 22, fixes had not been added to the mainline Linux kernel or linux-next.\n\nAdministrators should determine whether KSMBD is active and consider restricting network access until fixes become available.\nhttps://media.infosec.exchange/infosec.exchange/media_attachments/files/117/486/064/612/760/057/original/255430a2eb8f2f88.png\n",
"sig": "b3b2653309b87d4cc04a2c8ff654588a0c58a6acb93ccacbde3f34f2aedb77227e159a0dcd7b64a5abd67447f7dfba7b78a1c782def67787aaa9d0f0162bdfbc"
}
