Two Critical Linux KSMBD Flaws Made Public Before Kernel Fixes Are Ready

Linux servers running KSMBD, the kernel's built-in SMB file sharing server, are exposed to two publicly reported remote code execution flaws. Trend Micro's Zero Day Initiative rated both 9.0 on the CVSS scale. As of Thursday, neither has a named fix in the mainline kernel or in linux-next, the tree that feeds it. Phoronix reported that a maintainer has submitted a fix for one of them, but this has not been confirmed elsewhere.

The more worrying flaw, ZDI-CAN-33774, can be triggered before any network authentication, so any server running KSMBD on port 445 is exposed. It is a race condition in how KSMBD assigns its handlers, which can cause the server to read past the end of a buffer. A path to writing past the buffer also exists once an attacker has share access. The second flaw, ZDI-CAN-33549, is an integer underflow that needs the SMB Direct transport, an RDMA-capable network interface and a writable share.

Fixes to mainline typically take weeks to reach stable branches and distribution kernels. Neither flaw has a CVE identifier yet, because the kernel project assigns those only after a stable-tree fix exists. Administrators can check whether the module is active with systemctl status ksmbd or lsmod | grep ksmbd. Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's documentation.