Linux has recently disclosed two high-severity remote code execution vulnerabilities, tracked as ZDI-CAN-33774 and ZDI-CAN-33549 in the Linux kernel’s KSMBD-related components.

With this blog, we will break down what the critical Linux KSMBD vulnerabilities are about, the threat they pose, and what organizations should do to defend against them.

About the vulnerabilities

The two flaws affect different parts of how a system handles file sharing over a network.

ZDI-CAN-33774 – No login required

This flaw arises due to a timing problem in KSMBD, a service that lets Linux-based computers share files over a network. An attacker can exploit this problem without logging in, given that the vulnerable service is reachable over the network.

ZDI-CAN-33549 – Specific conditions required

This flaw affects the SMB Direct method of transferring data between computers using Remote Direct Memory Access. For an attacker to exploit this flaw, the system must support RDMA data transfer technology, and the attacker should have write access to a shared folder.  

Please note: Trend Micro’s Zero Day initiative classifies both vulnerabilities as remote code execution vulnerabilities. However, publicly reported proof-of-concept has demonstrated kernel memory disclosure and crashes rather than confirmed remote code execution.

The first vulnerability can be exploited if the service is reachable,  while the second needs additional requirements, which limits the systems that could be targeted.

What can attackers do with the vulnerabilities?

An attacker can exploit the vulnerabilities to:

• Potentially execute code on affected Linux systems remotely.
• Disclose sensitive kernel memory/corrupt kernel memory.
• Trigger system crashes or cause SMB file-sharing services to become unavailable.
• Cause a compromise of Linux systems running KSMBD.
• Targeted exposed KSMBD services through untrusted networks.

The actual risk depends on whether KSMBD is installed, enabled, reachable, and configured to use the affected functionality.

Official mitigation guidance

At the time of the referenced reports, neither vulnerability had a confirmed fix merged into the mainline Linux kernel.

• ZDI-CAN-33774: A fix was reported in the KSMBD maintainer’s tree but had not yet reached mainline.
• ZDI-CAN-33549: A fix had been submitted for a future kernel development cycle but was not yet confirmed as merged.

Until applicable fixes are available through the relevant Linux distribution, organizations should:

• Check whether KSMBD is running.
• Disable KSMBD if it is not required.
• Restrict SMB access to trusted networks and prevent exposure to untrusted networks.
• For environments using SMB Direct, review whether RDMA functionality can be temporarily restricted without disrupting required operations.
• Monitor official kernel and distribution security advisories for validated fixes.

These are temporary risk-reduction measures and do not replace installing the applicable security updates when they become available.

SharkStriker’s recommendations

• Identify Linux servers with KSMBD installed, loaded, or running.
• Disable KSMBD on systems that do not require it.
• Restrict SMB access to authorized hosts and trusted network segments.
• Review RDMA and SMB Direct configurations for potential exposure to ZDI-CAN-33549.
• Monitor Linux kernel logs for unexpected errors and crashes involving KSMBD.
• Track official kernel and distribution advisories and apply relevant fixes as soon as they become available.
• Include affected systems in vulnerability management and threat-hunting activities.

SharkStriker’s actions

• Threat intelligence reviewed using ZDI-related reporting and supporting technical analysis.
• Both vulnerability identifiers and their distinct prerequisites assessed.
• Detection opportunities identified for KSMBD service exposure and suspicious SMB activity.
• Threat hunting recommended for systems running the affected in-kernel SMB server.