CYBERSECURITYTRACKER
Permanent story citation

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11085

As cited

Copy frozen at (site build).

vulnerabilities

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Two remote code execution vulnerabilities in KSMBD, the Linux kernel's built-in SMB server, have been disclosed on public mailing lists before patches reached the mainline kernel. Both are rated CVSS 9.0 by Trend Micro's Zero Day Initiative (ZDI). One flaw (ZDI-CAN-33774) requires no network authentication to trigger, while the other (ZDI-CAN-33549) requires SMB Direct transport with RDMA-capable networking.

Why it matters: Organizations operating Linux servers with KSMBD enabled face immediate remote code execution risk from publicly disclosed vulnerabilities with no mainline kernel fix yet available.

VendorsTrend Micro
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary