Two serious flaws found in Linux file-sharing feature, no fix yet

Two serious security flaws have been reported in KSMBD, the file-sharing server built into the Linux kernel, and the main version of the kernel has no fix yet. Trend Micro's Zero Day Initiative rates both 9.0 out of 10 for severity. Both are remote code execution flaws, which means an attacker could run their own commands on a server from afar.

What changed

The flaws were reported on public mailing lists, where kernel developers talk, before any fix existed. The reports came from the Zero Day Initiative, which credits Trend Micro's AI scanner, TrendAI, as the finder. The kernel's security documentation was updated in May 2026 and says bugs found by AI tools are already public and should go to developer lists. The reports carried no patches.

That did not go over well. Stable-kernel maintainer Greg Kroah-Hartman answered one related report with: "Please fix your submission process."

The two flaws

The bigger worry is ZDI-CAN-33774. It needs no login, so any server running KSMBD on port 445 is exposed. A burst of short SMB1 packets followed by an SMB2 packet in the same network write confuses the server, which then reads past the end of a buffer. Once an attacker has access to a share, a path to writing past it also exists.

The second, ZDI-CAN-33549, is narrower. It needs three things at once: a network interface that supports RDMA, a writable KSMBD share, and a client using SMB Direct. In that case a size counter wraps around and a memory copy runs past the end of its buffer.

Who can relax

Red Hat Enterprise Linux does not include KSMBD by default, according to Red Hat's support documentation. Three of the five kernel reports sent in the same batch have nothing to do with SMB. They cover the networking stack, the VMware virtual GPU driver and the NVMe target driver, and none affects KSMBD servers. A sixth report concerns ConnMan, a separate network tool that is not part of the kernel.

What to do

The alert box above lists the checks and the steps. The short version: have your IT person or hosting provider confirm whether KSMBD is running, and limit who can reach it if it is.

What happens next

As of Thursday, neither flaw has a named fix in the mainline kernel or in linux-next, the testing tree that feeds it. Phoronix reported that SMB Direct maintainer Stefan Metzmacher submitted a fix for ZDI-CAN-33549, but that has not been confirmed elsewhere.

Even once a fix lands, it typically takes weeks to reach stable branches and the kernels Linux distributors ship. Neither flaw has a CVE number yet, the public tracking ID for security flaws, because the kernel project assigns those only after a stable-tree fix exists.