---
title: Unpatched Linux kernel bug reports from ZDI landed on public mailing lists, including two CVSS 9.0 ksmbd remote code execution flaws | ctxsec
url: https://ctxsec.com/items/linux-ksmbd-zdi-reports-public-lkml-oct-2026
description: ""
status: "confirmed (public LKML reports from ZDI, Oct 21; no CVEs or mainline fix yet; no exploitation reported)"
published: 2026-10-22
---

> 

[← Cybersecurity News](/news) · [markdown](/items/linux-ksmbd-zdi-reports-public-lkml-oct-2026.md)

confirmed (public LKML reports from ZDI, Oct 21; no CVEs or mainline fix yet; no exploitation reported)

2026-10-22

### Unpatched Linux kernel bug reports from ZDI landed on public mailing lists, including two CVSS 9.0 ksmbd remote code execution flaws

On **Oct 21** (UTC) Trend Micro's Zero Day Initiative sent several Linux kernel vulnerability reports to the private security@kernel.org address but copied public LKML and subsystem lists, so code paths, KASAN traces and reproduction details are now public. Greg Kroah-Hartman replied on-list asking ZDI to fix its submission process. The reports carry ZDI tracking IDs only; no CVEs have been assigned.

- **ZDI-CAN-33774** (CVSS 9.0, `AV:N/AC:H/PR:N`): a race in ksmbd, the in-kernel SMB server. Protocol ops are chosen when a request is queued but used when it is handled, so a short SMB1 buffer can be parsed as an SMB2 header. That leaks heap memory, and ZDI describes a path to an out-of-bounds write. It needs a won race and a guest share. The ksmbd maintainer says it is already fixed in his tree (commit `68f410faedaf`), but not yet in a mainline or stable release.
- **ZDI-CAN-33549** (CVSS 9.0): an integer underflow in ksmbd's SMB Direct (RDMA) path. It needs an RDMA device (including the software rxe driver), a writable share and SMB Direct. Per Phoronix a fix sits in a branch aimed at Linux 7.5.
- Also posted: an `skb_zerocopy` local privilege escalation (ZDI-CAN-33367), a vmwgfx out-of-bounds write LPE (ZDI-CAN-34068), an nvmet info leak (ZDI-CAN-34076) and, a day earlier, ZDI-CAN-32005.

Only hosts that actually run ksmbd (not user-space Samba) are exposed to the two RCEs. ksmbd is not enabled by default on many distributions.

Sources: [LKML archive: ZDI-CAN-33774 report and Greg KH reply (Oct 21-22)](https://lkml.iu.edu/2610.2/15259.html) · [lore mirror: ZDI-CAN-33774 thread with ksmbd maintainer fix reference](https://lore.landau.one/lkml/2026102244-decade-icing-82ed@gregkh/T/) · [Phoronix: Several Linux kernel vulnerabilities accidentally posted to public list (Oct 22)](https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities)