Zero Radar
← feed
CriticalVulnerabilityupdated 25 Oct 2026, 13:32 UTC

Linux file-sharing server (KSMBD) has two critical remote-takeover flaws

Some Linux computers can share files with Windows-style network shares. Two serious bugs in that sharing feature could let an outsider run their own code on the machine, and one of them needs no login.

No fix yet1 source, unconfirmed
SeverityCriticalVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?Not yetUse the workaround below until a patch ships
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker sends crafted trafficTargets the KSMBD file-sharing service
  2. 2Reaches SMB portPort 445 exposed; no login needed for one flaw
  3. 3Flaw triggers in kernelMemory-handling bug in KSMBD
  4. 4Code runs on serverAttacker gains remote code execution
  5. ResultAttacker controls the Linux server

What happened

Two remote code execution flaws (CVSS 9.0) in KSMBD, the Linux kernel's built-in SMB server, were disclosed publicly on mailing lists before kernel fixes existed. ZDI-CAN-33774 can be triggered before network authentication; ZDI-CAN-33549 requires the SMB Direct transport over an RDMA-capable network.

Why it is dangerous: If exploited, an attacker could run code with the privileges of the affected server, potentially taking full control of it. Any Linux server exposing KSMBD to a network is at risk, and the flaw being public before patches raises the chance of attacks.

Are you affected?

You are affected if you run a Linux kernel with KSMBD enabled and reachable over the network, and especially if you use SMB Direct over RDMA for ZDI-CAN-33549.

Linux kernel KSMBD (in-kernel SMB server); exact affected kernel versions not stated in the source.

What to do

  1. Check whether KSMBD is enabled on your Linux servers (for example, lsmod | grep ksmbd or systemctl status ksmbd).
  2. If you do not need SMB file sharing, disable KSMBD and block SMB ports (TCP 445) from untrusted networks.
  3. Restrict access to the SMB service to trusted hosts only, and disable SMB Direct/RDMA if not in use.
  4. Apply the official Linux kernel fix as soon as it is released and monitor kernel updates.

Timeline

  1. 22 Oct 2026, 17:01 UTC
    Publicly disclosed
  2. 22 Oct 2026, 17:01 UTC
    Reported by The Hacker News · The Hacker News

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-eebdb3f4
Disclosed
22 Oct 2026, 17:01 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 13:32 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Linux file-sharing server (KSMBD) has two critical remote-takeover flaws · Zero Radar