October 23, 2026
- Two KSMBD RCE flaws are public with no fix in mainline. ZDI-CAN-33774 requires no authentication and exposes any host running KSMBD on port 445: a burst of short SMB1 packets followed by an SMB2 packet in the same TCP write causes workers to handle SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. ZDI-CAN-33549 is an integer underflow in the SMB Direct path needing an RDMA-capable interface and a writable share. Neither has a CVE — the kernel assigns those only after a stable-tree fix — and ZDI's reports went to public lists without patches attached, consistent with kernel policy since May 2026 that AI-found bugs are already public. The finder credited is TrendAI, Trend Micro's AI scanner. RHEL does not ship KSMBD by default;
lsmod | grep ksmbdconfirms exposure. The Hacker News, Phoronix (discussion) · Vulnerabilities & Exploits
in Two Unpatched KSMBD RCEs Go Public — and an AI Scanner Found Them