Trend Micro’s Zero Day Initiative has posted details of two unpatched remote code execution flaws in the Linux kernel’s KSMBD SMB server to public kernel mailing lists. Both are rated CVSS 9.0, and no fix has reached mainline or linux-next.
ZDI-CAN-33774 Targets Any Server Running KSMBD on Port 445
ZDI-CAN-33774 is a race condition in how KSMBD assigns its handler table. A burst of short SMB1 packets followed by an SMB2 packet in a single TCP write makes worker threads read past the end of a buffer. The flaw needs no authentication and exposes any server running KSMBD on port 445.
The SMB Direct Underflow in ZDI-CAN-33549
ZDI-CAN-33549 is an integer underflow in the SMB Direct code path. Exploiting it requires an RDMA-capable network interface, a writable share and a client that negotiates SMB Direct. Those prerequisites make it narrower than the first flaw.
A Public Posting Driven by Kernel AI-Bug Rules
The finder is credited as TrendAI, Trend Micro’s AI scanner. Kernel documentation updated in May 2026 states that bugs found by AI are by definition public and should be reported to subsystem mailing lists. That rule is the reason the details appeared in public rather than through a private channel.
Phoronix said the public posting “seemingly was a mistake,” and Greg Kroah-Hartman questioned the public submissions. The posts include root causes, and for one networking bug a demonstrated attack chain. A separate report on the ConnMan DNS proxy, ZDI-CAN-32005, a stack overflow, was posted a day earlier.
What Is Still Missing: Patches and CVE Identifiers
No CVE identifiers exist yet, because they are assigned after a fix reaches a stable tree. An SMB Direct fix from maintainer Stefan Metzmacher is reportedly aimed at the next development cycle. Red Hat Enterprise Linux does not ship KSMBD by default. No attacks in the wild have been reported.
Why the Gap Between Disclosure and Distribution Matters
Mainline fixes typically take weeks to reach stable kernels, and distributions need further time after that. In the meantime, the technical details are public. Anyone reading the mailing lists has the root causes of both flaws and, for one bug, an attack chain, while defenders have no patch to apply.
The Hacker News and SecurityOnline both noted that the exposure falls on servers that run KSMBD, the in-kernel SMB server that serves as an alternative to the user-space Samba implementation. Systems that do not load the module are not in scope.
Reported Checks for Systems Running KSMBD
The coverage listed checks that administrators can run, including systemctl status ksmbd and lsmod | grep ksmbd, and noted that disabling the module or restricting port 445 are options until a patch is available.
The mailing list posts are not the only public material. The ZDI-CAN-32005 report on the ConnMan DNS proxy, a stack overflow, appeared one day before the KSMBD reports, which means three separate unpatched flaws from the same scanner were public within about 48 hours.
A Test Case for AI-Found Kernel Bugs
The episode brings a policy question into view. The kernel’s rule that AI-discovered bugs go straight to public lists means that automated scanners can place unpatched, high-severity flaws in front of the public before maintainers have prepared a fix. Kroah-Hartman’s questioning of the postings shows that the maintainers themselves are not settled on how the rule should work in practice.
Whether the two KSMBD reports lead to a change in the documentation is not yet known. What is known is that two CVSS 9.0 flaws, one unauthenticated and reachable over the standard SMB port, are documented in public with no mainline remedy available, and that the pipeline for assigning CVE numbers cannot start until a stable-tree fix exists.
