Public ZDI Disclosures Expose Unpatched Linux KSMBD Flaws Rated CVSS 9.0

Trend Micro’s Zero Day Initiative publicly posted reports of several unpatched Linux kernel vulnerabilities, including two KSMBD flaws rated CVSS 9.0 for potential remote code execution. ZDI-CAN-33774 involves a protocol-dispatch race that can route SMB1 requests through SMB2 handlers; ZDI-CAN-33549 involves an integer underflow in SMB Direct’s RDMA buffer accounting. Published evidence demonstrates kernel-memory disclosure and out-of-bounds writes, not successful code execution. Exposure depends on whether the optional KSMBD server and relevant features are enabled; the SMB Direct reproduction also requires suitable share access. At publication, mainline fixes and assigned CVE identifiers were not reported, although some remediation was reportedly being tested or held in development branches. No exploitation in the wild was reported.

Other disclosures describe unauthorized modification of root-owned files through skb_zerocopy(), a local privilege-escalation risk in the VMWGFX graphics driver, and information disclosure in the NVMET storage target. Related coverage also identifies a stack-buffer overflow in ConnMan, a separate service rather than a kernel component. Linux maintainer Greg Kroah-Hartman questioned why reports were sent to public lists without patches. Although initial coverage characterized the disclosures as accidental, ZDI’s routing rationale remained unconfirmed, and AI involvement was not established. Administrators should inventory KSMBD deployments, disable unnecessary KSMBD and SMB Direct functionality, restrict SMB access to trusted networks, and monitor distribution advisories for supported fixes. The reports do not establish a comprehensive affected-version range, so tested release-candidate kernels should not be treated as the only potentially affected versions.