---
title: Tip: until the ksmbd fixes ship, find Linux hosts running the in-kernel SMB server and turn it off or fence port 445 | ctxsec
url: https://ctxsec.com/items/tip-find-and-disable-ksmbd-before-fix
description: ""
status: "guidance based on the public ZDI ksmbd reports (Oct 21-22)"
published: 2026-10-22
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-find-and-disable-ksmbd-before-fix.md)

guidance based on the public ZDI ksmbd reports (Oct 21-22)

2026-10-22

### Tip: until the ksmbd fixes ship, find Linux hosts running the in-kernel SMB server and turn it off or fence port 445

- **Find it:** `lsmod | grep ksmbd`, `systemctl status ksmbd` and `ss -ltnp 'sport = :445'`. A listener on 445 with no `smbd` process behind it is a sign of ksmbd. Check NAS and appliance images too, since that is where ksmbd usually turns up.
- **If you don't need it:** stop the service, then `modprobe -r ksmbd` and blacklist the module (for example `echo "blacklist ksmbd" > /etc/modprobe.d/no-ksmbd.conf`).
- **If you do:** remove guest shares (ZDI-CAN-33774 needs one), turn off SMB Direct/RDMA unless you use it (ZDI-CAN-33549 needs it), and allow TCP 445 only from trusted subnets. Never expose it to the internet.
- **Then:** watch your distribution's kernel advisories for the ksmbd fixes, since no CVEs exist yet to track.

Sources: [LKML archive: ZDI-CAN-33774 report and Greg KH reply (Oct 21-22)](https://lkml.iu.edu/2610.2/15259.html) · [Phoronix: Several Linux kernel vulnerabilities accidentally posted to public list (Oct 22)](https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities)