- Trend Micro's Zero Day Initiative reported two remote code execution flaws in Linux's KSMBD file server, ZDI-rated 9.0. The Hacker News says neither had a named fix in mainline Linux.
- The reports credit an AI scanner and went to public mailing lists without patches. No CVE IDs exist yet, so scanners that rely on them may miss these flaws.
- Run a quick check for KSMBD on Linux servers. The pre-authentication flaw affects any server running the module on port 445.
Linux kernel guidance now says that a bug found by an AI tool counts as public knowledge. This case shows how that rule can play out. Two serious file-server flaws appeared on open mailing lists, and no mainline fix was visible. One reading is that the quiet period used to prepare a patch may not apply to AI-found bugs. The sources cover a single batch of reports, so treat this as one case, not a trend.
WebPulse could not read the original Zero Day Initiative (ZDI) posting on the Linux kernel mailing list. A bot-check page blocked it. The details below come from The Hacker News, which reported on October 22, 2026.
What was reported
KSMBD is the Linux kernel's built-in server for SMB, the protocol behind Windows-style file sharing. The Hacker News says Trend Micro's ZDI rated two remote code execution flaws in it at 9.0. That number is ZDI's own severity score for the flaws. Remote code execution means an attacker can run their own commands on the machine from afar.
As of Thursday, the outlet could point to no named patch for either bug. That held for the main kernel tree and for linux-next, the staging tree where changes are gathered before they reach mainline. Phoronix, a Linux news site, said maintainer Stefan Metzmacher had submitted a fix for one of them. The Hacker News says nobody else has confirmed that.
Neither flaw has a CVE identifier. According to The Hacker News, the kernel project issues one only once a fix is available in a stable tree. Until then, any tool that tracks flaws by CVE ID has nothing to match.
How the two flaws work
The more serious flaw is ZDI-CAN-33774. It needs no login, so any server running KSMBD on port 445 is exposed. The Hacker News describes a race condition in how KSMBD assigns its handler table. An attacker packs several short SMB1 packets and one SMB2 packet into a single network write. The server then applies the SMB2 routine to SMB1 data and reads beyond the end of the smaller memory block. Once an attacker can reach a share, there is also a route to writing past that block, the report says.
The second flaw, ZDI-CAN-33549, is narrower. It is an integer underflow in the SMB Direct path. A client supplies memory descriptors where the first one is larger than the payload it declared. The server's size counter wraps around, and a later copy overruns its allocated buffer.
Three conditions must all hold, The Hacker News says. The server needs an RDMA-capable network interface, either hardware or the rxe software driver. It needs a writable KSMBD share. And the client must negotiate SMB Direct. Servers that lack any one of the three are not exposed to this flaw.
Why the reports arrived without patches
The reports name TrendAI, an AI scanner from Trend Micro, as the discoverer. The Hacker News points to the kernel's security documentation, revised in May 2026 after guidance from Linus Torvalds. On that logic, reports on AI-discovered bugs go to the open developer lists of the affected subsystem.
ZDI's routing appeared to follow that rule. The Hacker News says it copied public lists alongside the private kernel security address and attached no patches to any report.
Stable-kernel maintainer Greg Kroah-Hartman was not pleased. Within minutes, he answered three of the five kernel reports sent in this batch. Two of his replies concerned a VMware graphics driver and the NVMe driver. On the second, he asked whether it was really "no patch, and sent to a public list?" Those two reports are unrelated to KSMBD.
Here the argument is WebPulse's own, not the sources'. If the kernel treats AI-found bugs as public from the start, and the finder does not supply a fix, the reader who waits for a patch learns of the risk late. The sources do not show how fast scanners find bugs compared with how fast people fix them. They do show that these two flaws were public while mainline had no named fix.
What to do now
Two commands on a Linux host, systemctl status ksmbd and lsmod | grep ksmbd, show whether KSMBD is loaded. The Hacker News cites Red Hat's support documentation, which says Red Hat Enterprise Linux ships without KSMBD by default. Other distributions and appliance builds may differ, so verify rather than assume.
The report adds that fixes typically take weeks to move from mainline to stable branches and distribution kernels. Leaders can ask four questions of their teams.
Which of our Linux servers, storage boxes or network devices run KSMBD? Is port 445 reachable from networks we do not control? Do any of those hosts use RDMA hardware or the rxe driver? Who tracks flaws that have no CVE ID yet, so they do not slip past our scanners?
Keep the response scoped. The Hacker News says three of the five kernel reports in the batch are unrelated to SMB, and two of those do not affect KSMBD servers. Respond to what you actually run.
A fix that does not exist cannot be installed. An inventory can be built today.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Trend Micro's Zero Day Initiative (ZDI), via the Linux kernel mailing list (lkml).
