Threat Pulse 62High
Two CVSS 9.0 Linux KSMBD RCE flaws posted to public kernel lists before fixes exist
Severity 5ActiveconfirmedWeb servers and gatewaysAI-related

Trend Micro's ZDI sent two unpatched remote code execution bugs in the Linux kernel's in-kernel SMB server to public mailing lists: ZDI-CAN-33774, an unauthenticated handler race on port 445, and ZDI-CAN-33549, an integer underflow in SMB Direct. Both were found by Trend's TrendAI scanner. No mainline fix or CVE existed at disclosure; admins should check whether ksmbd is loaded and restrict port 445.

What to do: No mainline patch at disclosure; a fix for ZDI-CAN-33549 was reportedly submitted for the next cycle; RHEL does not ship KSMBD by default.

AI angle: Found by an AI vulnerability scanner (TrendAI); the kernel's own policy treats AI-found bugs as already public.

· 14 days ago · Linux hosts with the ksmbd module active · The Hacker News
SourcesThe Hacker NewsSlashdot
Why this score

Linux servers running KSMBD (impact 3), details public without a PoC (exploitability 1), general sector (criticality 0), no fix available (+1).

Back to the board

Updated Nov 5, 01:47 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.