Two critical remote code execution (RCE) flaws affecting Linux servers running KSMBD, the kernel's built-in SMB server, have been publicly disclosed. These vulnerabilities have received a CVSS score of 9.0 from Trend Micro's Zero Day Initiative.
One flaw, identified as ZDI-CAN-33774, can be exploited before any network authentication is required. The second flaw, ZDI-CAN-33549, necessitates the use of the SMB Direct transport and an RDMA-capable network for exploitation.
As of the disclosure, no fix for these vulnerabilities has been integrated into the mainline Linux kernel.
By the numbers
- CVSS score for KSMBD flaws
- 9.0
Sources and references
Original report
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00EH3E25
Cite this
APA
Interestana AI Editorial. (2026, October 22). Two Critical Linux KSMBD Flaws Disclosed Before Kernel Fixes. Interestana. https://interestana.com/articles/two-cvss-90-linux-ksmbd-rce-flaws-disclosed-on-public-mailing-lists-before-kernel-fixes-00eh3e25
MLA
“Two Critical Linux KSMBD Flaws Disclosed Before Kernel Fixes.” Interestana, 22 Oct. 2026, interestana.com/articles/two-cvss-90-linux-ksmbd-rce-flaws-disclosed-on-public-mailing-lists-before-kernel-fixes-00eh3e25.
Chicago
Interestana AI Editorial. “Two Critical Linux KSMBD Flaws Disclosed Before Kernel Fixes.” Interestana, October 22, 2026. https://interestana.com/articles/two-cvss-90-linux-ksmbd-rce-flaws-disclosed-on-public-mailing-lists-before-kernel-fixes-00eh3e25.
BibTeX
@misc{interestana_00eh3e25,
author = {{Interestana AI Editorial}},
title = {{Two Critical Linux KSMBD Flaws Disclosed Before Kernel Fixes}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/two-cvss-90-linux-ksmbd-rce-flaws-disclosed-on-public-mailing-lists-before-kernel-fixes-00eh3e25},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html}
}Credit the source
Original reporting: The Hacker News, “Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes”, https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe