Linux kernel maintainers scramble after KSMBD remote execution flaws leak to LKML

Linux kernel maintainers scramble after KSMBD remote execution flaws leak to LKML

Linux kernel maintainers are pushing out emergency patches following an accidental disclosure leak that exposed two critical remote code execution vulnerabilities in the kernel in-tree SMB3 server, KSMBD, directly to public mailing lists. Tracked under Zero Day Initiative case identifiers ZDI-CAN-33774 and ZDI-CAN-33549, both flaws carry a critical CVSS base score of 9.0. The vulnerabilities allow unauthenticated remote attackers with network access to TCP port 445 to trigger kernel heap memory corruption and achieve arbitrary code execution in Ring 0.

The disclosure occurred when vulnerability reports submitted by researchers through Trend Micro Zero Day Initiative were mistakenly copied to the public Linux Kernel Mailing List (LKML) and subsystem development lists rather than being confined to the private kernel security team. The public distribution of complete technical root cause analyses and proof-of-concept mechanics sparked immediate friction between security researchers and core kernel maintainers, who had to rapidly coordinate patch integration across active git branches before malicious exploitation could proliferate.

KSMBD was merged into mainline Linux in kernel version 5.15 as a high-performance, kernel-space alternative to user-space Samba daemon (smbd), optimized for high-throughput network-attached storage and RDMA fabrics. While major enterprise distributions like Red Hat Enterprise Linux do not enable KSMBD by default, the module is widely compiled and active across modern cloud container hosts, high-performance computing clusters, and embedded storage appliances. For exposed deployments, the flaws present an immediate pre-authentication compromise vector.

Technical execution flow of the KSMBD protocol dispatch race and heap memory corruption

Zoom

Vulnerability telemetry, component breakdown, and disclosure parameters

Both disclosed vulnerabilities have been evaluated at CVSS v3.1 base scores of 9.0. The attack vector is Network (AV:N), attack complexity is High (AC:H) due to race-window timing or RDMA buffer alignment requirements, privileges required are None (PR:N) for the protocol dispatch flaw, user interaction is None (UI:N), and the scope is Changed (S:C), reflecting host kernel takeover and container escape capabilities.

Table 1: Technical attributes, affected subsystems, and remediation status for KSMBD remote execution vulnerabilities.

Investigation Parameter	Technical Value	Operational Context
Primary Flaw Identifier	ZDI-CAN-33774	Protocol dispatch race condition in KSMBD PDU parser
Secondary Flaw Identifier	ZDI-CAN-33549	Integer underflow in SMB Direct (RDMA) transmit path
CVSS v3.1 Base Score	9.0 (Critical)	Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Subsystem	fs/smb/server	Linux in-tree SMB3 server implementation (KSMBD)
Target Network Port	TCP 445	Default SMB protocol network transport port
Authentication Requirement	Unauthenticated (ZDI-CAN-33774)	No valid credentials required for protocol confusion
Upstream Fix Commit	68f410faedaf	Patch committed by KSMBD maintainer Namjae Jeon
Disclosure Platform	Public LKML mailing lists	Accidental public leak prior to stable tree tagging
Primary Workaround	rmmod ksmbd	Unloading kernel module neutralises attack surface instantly
Enterprise Default Status	Disabled in RHEL/CentOS	Enabled in custom storage NAS and bleeding-edge distros

Anatomy of the protocol dispatch race and SMB Direct arithmetic underflow

The core flaw in ZDI-CAN-33774 centres on how KSMBD handles concurrent protocol operations across worker threads. When clients communicate over TCP port 445, the connection structure stores function pointers in conn->ops to route incoming Protocol Data Units (PDUs) to appropriate protocol handlers. In mixed SMB environments, KSMBD allows dynamic switching between SMB1 legacy negotiation and SMB2/SMB3 modern dialects.

An attacker transmits a specially constructed burst of short SMB1 packets immediately followed by an SMB2 packet within a single TCP write operation. Because connection state updates lack atomic synchronization across worker threads, a race window opens where the incoming SMB1 payload is processed using an SMB2 handler function. The SMB2 handler expects longer, structured header boundaries and lacks length verification for the shorter SMB1 data. This results in out-of-bounds heap reads that disclose sensitive kernel pointers, followed by out-of-bounds writes in functions like smb2_set_info and parse_sec_desc, granting memory corruption primitives.

Concurrently, ZDI-CAN-33549 exposes an arithmetic underflow flaw in the SMB Direct transmission routine (smbdirect_connection_rdma_xmit). When clients negotiate SMB Direct over Remote Direct Memory Access (RDMA) networks, the server calculates remaining payload buffer lengths. If an attacker submits malicious RDMA descriptors where the initial buffer length exceeds the total declared payload, an integer underflow causes the length variable to wrap into a large unsigned integer, driving a kernel heap buffer overrun.

Kernel hardening roadmap and server mitigation checklist

Until Linux distributions distribute official security kernel builds incorporating commit 68f410faedaf and associated RDMA patches, administrators should implement defense-in-depth isolation.