Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
Two pre-authentication RCE flaws (CVSS 9.0) in the Linux kernel's KSMBD SMB server were disclosed on public mailing lists with no mainline fix available — organisations should disable KSMBD immediately to close the exposure window.
Summary written by editorial AI · Source link below
Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel.
One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network
Editorial Analysis
Unpatched pre-auth kernel-level RCE in a file-sharing component is as critical as it gets; the public disclosure timeline means exploit code will follow quickly.
Audit all Linux hosts for KSMBD module status and disable it enterprise-wide until a mainline kernel fix is released.
Two critical unpatched Linux kernel vulnerabilities allow remote takeover of file servers — immediate mitigation action is required.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- Compromised TLS Certificates3d