Two vulnerability reports concerning Linux’s KSMBD file server appeared on public mailing lists on October 21, with ZDI assigning each a CVSS 3.0 score of 9.0. Hong Kong organizations using the service should check configurations, restrict access and confirm patch status with suppliers. The reported trigger conditions do not apply to every Linux host.
Which file-sharing service is involved?
The Linux kernel documentation describes KSMBD as an in-kernel SMB file server. It is a different implementation from the usual userspace Samba smbd service. Running Linux, installing Samba or connecting to an SMB share does not by itself establish exposure to these reports.
ZDI’s official tracker lists ZDI-CAN-33549 and ZDI-CAN-33774 at 9.0, both with an October 21, 2026 notification date. These are ZDI research tracking identifiers, not CVE identifiers. A severity score does not establish equal exploitability across configurations.
The reports have different prerequisites
ZDI-CAN-33549: The original ZDI report describes an SMB Direct integer underflow, classified as a remote code execution risk. Its stated requirements include an RDMA device, a writable share and SMB Direct. Exposure cannot be assumed for services without those features.
ZDI-CAN-33774: The second ZDI report describes a protocol-dispatch race, with out-of-bounds memory access paths and a guest-share prerequisite. Both reports tested Linux 7.3-rc3. That is a tested build, not a complete affected-version list or a recommended safe release.
The race report has a maintainer fix; verify shipped updates
The two issues have different status. In a reply concerning the first issue, the reporter was asked to test an SMB Direct development branch that might already address it. That tentative response still calls for testing.
For ZDI-CAN-33774, maintainer Namjae Jeon’s October 22 reply states the issue is fixed and links a commit in the SMB maintainer tree. This does not establish that every stable kernel or enterprise distribution has shipped the update. Obtain supplier confirmation for the actual distribution, device and kernel in use.
Four practical checks for IT teams
- Inventory the real service. Confirm KSMBD use, kernel version, SMB Direct/RDMA, guest access and writable shares. Ask NAS and appliance suppliers which implementation they use.
- Restrict network reachability. Limit sharing to trusted networks with a business need; review firewall rules, remote access and access between network segments.
- Reduce unnecessary permissions. Review guest and write access and disable unneeded features. Disabling SMB Direct alone does not resolve the separate race report.
- Track and verify updates. Follow supplier notices, retain backup and recovery arrangements, and verify the running kernel and sharing functions after restart.
Verified on October 22, 2026. These defensive recommendations are this website’s synthesis. Access restrictions and permission changes reduce exposure but do not replace an applicable, confirmed fix.