What happened
Two critical remote code execution vulnerabilities affecting Linux servers running KSMBD, the kernel's native SMB server, were disclosed on public mailing lists prior to the release of kernel patches. The flaws, rated 9.0 by Trend Micro's Zero Day Initiative, impact affected deployments without a current fix in the mainline kernel. The first, identified as ZDI-CAN-33774, can be exploited before any network authentication occurs, allowing an attacker to execute arbitrary code remotely. The second, ZDI-CAN-33549, requires the SMB Direct transport and a network supporting Remote Direct Memory Access (RDMA), but similarly allows remote code execution. These vulnerabilities are confirmed to be actively exploited in the wild. As they were publicly disclosed before any vendor patch, affected organisations face an immediate threat without available mitigations through official fixes. The severity rating of 9.0 underscores the critical nature of these flaws, highlighting the risk of unauthenticated remote exploits leading to complete system compromise. Who is affected Organisations running Linux systems with KSMBD enabled are vulnerable. This includes affected deployments exposed to untrusted networks where SMB services are accessible, especially those configured with SMB Direct transport capabilities and RDMA networking. Systems that do not publicly expose SMB services or do not support SMB Direct are likely not at risk—however, the widespread nature of the vulnerability suggests a broad potential impact across affected Linux environments. Recommended actions
Immediately review network exposure of SMB services, particularly on Linux systems leveraging KSMBD, and restrict access where possible. Monitor network traffic and system logs for signs of exploitation activity related to these vulnerabilities. Apply kernel security updates or patches once they become available to address the disclosed flaws. Pending patch releases, consider disabling SMB Direct transport and RDMA functionalities if not essential. Implement strict network controls, such as firewall rules, to limit SMB traffic to trusted sources and prevent unauthenticated access from external networks.
