# Linux KSMBD - ZDI-CAN-33774 / ZDI-CAN-33549 (October 2026)

Defensive pack for two critical KSMBD remote code execution issues disclosed on the public kernel mailing list (2026-10-21/22).

| ID | Summary | Auth | Extra requirements | CVSS |
|---|---|---|---|---|
| **ZDI-CAN-33774** | Protocol dispatch race (SMB1 work handled with SMB2 ops) → OOB read/write class RCE | Unauthenticated network path to KSMBD on **TCP/445** | Race; disclosure text also mentions guest-share context for the write path | **9.0** |
| **ZDI-CAN-33549** | SMB Direct integer underflow in `smbdirect_connection_rdma_xmit` | Authenticated SMB session implied by share use | **RDMA / SMB Direct** + **writable share** | **9.0** |

| Field | Status (as of 2026-10-22 Europe/London) |
|---|---|
| CVE | **None assigned yet** (kernel typically assigns after stable fix) |
| Mainline / distro patch | **Not confirmed** in mainline/stable at pack build; treat as unpatched |
| Primary sources | LKML threads on lore.kernel.org; public pre-advisory listing (CAN ids listed) |

**Unverified:** Exact distro package versions affected; whether a given listener on 445 is ksmbd vs Samba without process attribution; claimed fix commits circulating in secondary coverage - re-validate against lore.kernel.org / kernel git before declaring patched.

## Files

| File | Purpose |
|---|---|
| `check_ksmbd.sh` | Linux-only read-only posture check |
| `kql/ksmbd_kernel_and_445.kql` | Syslog oops + DeviceNetworkEvents inbound 445 |
| `sigma/syslog_ksmbd_kernel_oops.yml` | Sigma for ksmbd-related kernel oops lines |
| `tests/` | Mocked CHECK_ROOT fixtures |

## Usage

```bash
sudo bash check_ksmbd.sh
CHECK_ROOT=/path/to/fixture bash check_ksmbd.sh   # offline tests
```

## Verdicts

| Verdict | Meaning | Exit |
|---|---|---|
| LIKELY VULNERABLE | `ksmbd` loaded (or `ksmbd.mountd` running) **and** TCP/445 listening - **no patch exists** | 1 |
| PATCHED | Module not loaded, mountd not running (and/or blacklisted). This means **mitigated / not present**, not “vendor patch applied”. | 0 |
| UNKNOWN | Partial visibility (loaded but listen unclear, or :445 with ksmbd.ko on disk but owner unclear) | 2 |
| ERROR | Unexpected failure | 3 |

## Mitigations (until a kernel patch is available)

1. **Unload and stop**
   ```bash
   sudo systemctl stop ksmbd ksmbd.service 2>/dev/null || true
   sudo rmmod ksmbd 2>/dev/null || true
   ```
2. **Blacklist**
   ```bash
   echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf
   ```
3. **Firewall** - block inbound TCP/445 from untrusted networks (host firewall and network ACL). Prefer not exposing SMB to the internet at all.
4. **RDMA / SMB Direct** - if you do not need it, disable SMB Direct / unload soft-RoCE (`rdma_rxe`) and remove writable guest shares to reduce ZDI-CAN-33549 exposure.
5. Prefer userspace Samba with a maintained package if SMB serving is required, and keep that patched separately.

## Proactive

- Inventory hosts with `lsmod | grep ksmbd`, `ksmbd.mountd`, or listening 445.
- Apply blacklist + firewall before internet exposure reviews complete.
- Deploy Sigma/KQL for ksmbd oops and unexpected inbound 445.

## Reactive

1. Preserve `dmesg` / journalctl around any ksmbd oops.
2. Capture network telemetry for inbound 445 (sources, volume, bursts).
3. If compromise suspected on an exposed ksmbd host: isolate, forensic image, credential rotation - standard IR (no exploit steps here).

## Limits

- Checker is **read-only** (no exploit, no SMB negotiation tests).
- “PATCHED” here means **not running ksmbd**, not a fixed kernel CVE build.
- KQL is **untested against a live tenant**; DeviceName heuristics for “Linux” are coarse - adjust to `DeviceInfo.OSPlatform` in your environment.
- Secondary news coverage may claim fix commits; confirm in kernel trees before changing verdict logic.