Two critical Linux KSMBD RCE flaws (CVSS 9.0) have been publicly disclosed with no kernel fix yet. One can be triggered pre-auth. Here's what you need to know.
Linux servers running KSMBD, the kernel's built-in SMB server, are in a tough spot. Two remote code execution (RCE) vulnerabilities, both rated 9.0 by Trend Micro's Zero Day Initiative, have been publicly disclosed. And here's the kicker: there's no fix in the mainline kernel yet.
If you're running KSMBD on your servers, you need to pay attention. These aren't your run-of-the-mill bugs. They're critical, and they're already out in the open.
### What's the Deal with These Flaws?
The first one, ZDI-CAN-33774, is particularly nasty. It can be triggered before any network authentication. That means an attacker doesn't need valid credentials to exploit it—they just need to reach the service. In a world where perimeter security is already stretched thin, that's a serious concern.
The second, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network. So it's a bit more niche, but if you're running high-performance setups with RDMA, it's still a risk.
Both were disclosed on public mailing lists, which means the details are out there for anyone to see. That includes the bad actors.
### Why KSMBD Matters
KSMBD is the kernel's built-in SMB server. It's designed to be lightweight and fast, and it's increasingly used in embedded systems, NAS devices, and even some cloud setups. If you're using it, you're part of a growing group.
But here's the thing: because it's in the kernel, patching isn't always straightforward. You can't just update a user-space package and call it a day. You're waiting on kernel fixes, and that can take time.
### What Should You Do?
First, don't panic. But do take this seriously. Here are a few steps you can take right now:
- **Check if you're running KSMBD.** It's not enabled by default on most distributions, but if you're using it, you probably know.
- **Limit network exposure.** If KSMBD is exposed to the internet, lock it down. Use firewalls, VPNs, or whatever you can to reduce the attack surface.
- **Monitor for unusual activity.** Since one flaw can be triggered pre-auth, watch for strange SMB traffic or unexpected connections.
- **Stay tuned for patches.** The kernel team is likely working on fixes, but until they're released, you're in a holding pattern.
> "The disclosure of these flaws before a fix is available puts defenders in a tough spot. It's a reminder that transparency, while valuable, can also be a double-edged sword."
### The Bigger Picture
This isn't the first time kernel-level vulnerabilities have been disclosed before patches. It's a recurring theme in open-source security. The debate between responsible disclosure and transparency is ongoing, and incidents like this fuel the fire.
For now, your best bet is to stay informed and be proactive. Keep an eye on kernel updates, and don't assume you're safe just because you're behind a firewall.
We'll keep you posted as more details emerge. In the meantime, stay safe out there.
