In this article
  1. What happened
  2. Why it matters
  3. What to do now
  4. Updates

TL;DR: Trend Micro’s Zero Day Initiative (ZDI) posted details of a flaw in ksmbd, the SMB file server built into the Linux kernel, to a public kernel mailing list on October 21, 2026. ZDI rates it CVSS 9.0 and calls it a remote code execution vulnerability. The ksmbd maintainer says it “has already been fixed” in his own tree, but as of our check the fix is not in Linus Torvalds’ mainline kernel, and the report has a ZDI tracking number rather than a CVE ID, so vulnerability scanners that work from CVEs won’t flag it. Most Linux machines don’t run ksmbd. If yours does, mainly a NAS, router or small Linux file server sharing folders over SMB, firewall port 445 to trusted machines and turn off guest shares until a patched kernel ships.

What happened

At 21:36 UTC on October 21 (5:36 a.m. Manila on October 22), ZDI sent “ZDI-CAN-33774: Linux Kernel KSMBD Protocol Dispatch Race Condition Remote Code Execution Vulnerability” to the public linux-cifs mailing list. The report:

  • gives a CVSS score of 9.0, with a vector that means reachable over the network, no login or user action needed, hard to pull off, and high impact on confidentiality, integrity and availability beyond the vulnerable component itself;
  • says it was tested on kernel 7.3-rc3 on Debian trixie;
  • says a short SMB1 request can be handled with SMB2 code, which reads past the end of the buffer and can “leak OOB read memory back to attacker,” and that “there is also a path to OOB write”;
  • says “the trigger requires race and guest share.”

At 04:45 UTC on October 22 (12:45 p.m. Manila), kernel maintainer Greg Kroah-Hartman replied: “And again, no patch, and a public list?” Bug reports like this normally go to the kernel’s private security team first, with time to ship a fix.

At 12:17 UTC (8:17 p.m. Manila), ksmbd maintainer Namjae Jeon replied that “this issue has already been fixed” and linked commit 68f410faedaf, “ksmbd: wait for negotiation before receiving another PDU,” in his kernel.org tree. The commit, credited to a different reporter, was written on September 30 and committed on October 21. Its message describes the same problem: a pipelined SMB2 request “can therefore make the worker handle an earlier, shorter SMB1 request with SMB2 operations and read beyond its buffer.”

When we checked mainline’s fs/smb/server/server.c at 1:06 p.m. Manila on October 23, the change wasn’t there yet. Until it reaches mainline and the stable kernels your distribution ships, there’s no update to install.

ZDI also sent a second CVSS 9.0 ksmbd report, ZDI-CAN-33549, to the public linux-cifs list at 21:17 UTC on October 21. It describes an integer underflow in the SMB Direct (RDMA) code that needs an RDMA device and a writable share. Stefan Metzmacher replied at 22:16 UTC (6:16 a.m. Manila on October 22), pointing the reporter to his work-in-progress for-7.5/smbdirect branch for testing: “I guess it’s already fixed with that.” ZDI’s upcoming advisories page lists both ZDI-CAN-33549 and ZDI-CAN-33774. Phoronix reports that ZDI posted several other kernel reports to public lists at the same time. SMB Direct is a separate kernel option, CONFIG_SMB_SERVER_SMBDIRECT, that is off by default and needs RDMA networking.

Why it matters

ksmbd is off by default in the kernel (CONFIG_SMB_SERVER defaults to n), and it only serves files once the userspace tools in ksmbd-tools start it. Samba, the more common Linux file server, runs outside the kernel, and these reports don’t cover it. So most small offices aren’t affected. The exceptions are the kind of box that sits quietly on a small office network: a home-built NAS, an OpenWrt router sharing a USB drive (OpenWrt packages ksmbd as ksmbd-server), or a Linux server someone set up to share folders. The report needs a guest share, and guest access is the setting people often switch on for convenience.

The missing CVE also matters. Many patch dashboards only show issues with a CVE ID, so this one won’t appear there until a fix lands and an ID is assigned.

What to do now

  1. Check whether you run ksmbd. On the Linux box, lsmod | grep ksmbd shows whether the module is loaded, pgrep -a ksmbd.mountd shows whether the server daemon is running, and ss -ltnp | grep ':445' shows what is listening on the SMB port. If nothing turns up, these reports don’t affect that machine.
  2. If it is running, limit who can reach port 445. Allow only the machines that need the share, and never forward port 445 from the internet.
  3. Turn off guest access. In ksmbd.conf, make sure shares use guest ok = no and the global section uses map to guest = never. Both are the defaults, so look for anywhere they’ve been changed. Then reload with sudo ksmbd.control --reload.
  4. If you don’t need it, stop it. sudo ksmbd.control --shutdown stops the server, and sudo modprobe -r ksmbd unloads the module. Samba is the alternative if you still need SMB shares.
  5. Watch for the kernel update. Install your distribution’s or device maker’s kernel update once it includes the ksmbd fix. On a NAS or router, that means a firmware or package update from the vendor.

Patching other servers this week? See our stories on the critical PHP security release and Plex2Shell.

Updates

  • Oct 23, 2026, 1:50 p.m. Manila: First published. We’ll add a dated note when the fix reaches mainline or a stable kernel, or a CVE is assigned.

Sources & method

Sources

Method. Last checked October 23, 2026, at 1:50 p.m. Manila time (05:50 UTC). The ZDI-CAN-33774 details and quotes come from the mailing-list messages, the fix description from the commit, and the default settings and commands from the kernel’s Kconfig and ksmbd-tools’ docs. We checked mainline for the fix ourselves. ZDI-CAN-33549 details come from ZDI’s report and Stefan Metzmacher’s reply on linux-cifs, and the listing of both reports from ZDI’s upcoming advisories page. Only the claim that other reports were posted at the same time comes from Phoronix, labeled as a secondary source. Who is likely to run ksmbd, and the steps in “What to do now,” are our own judgment. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.