title: KSMBD Kernel Oops BUG or KASAN in Syslog
id: 5d9a1c2e-77b4-4f0a-8c3d-1e9b6a0f2d48
status: experimental
description: >
  Detects Linux kernel log lines that reference ksmbd (or related smb2pdu /
  smbdirect symbols) together with oops, BUG, KASAN, or panic markers. Useful
  as a reactive signal around ZDI-CAN-33774 / ZDI-CAN-33549 disclosures
  (CVSS 9.0 KSMBD RCE class issues; no CVE at time of writing). Presence of an
  oops is not proof of exploitation.
references:
  - https://lore.kernel.org/lkml/
author: detection-pack
date: 2026-10-22
level: high
tags:
  - attack.impact
  - attack.t1203
logsource:
  product: linux
  service: syslog
detection:
  selection_component:
    message|contains:
      - 'ksmbd'
      - 'smb2pdu'
      - 'smbdirect'
  selection_crash:
    message|contains:
      - 'BUG:'
      - 'Oops'
      - 'KASAN'
      - 'kernel BUG'
      - 'slab-out-of-bounds'
      - 'Unable to handle'
      - 'panic'
  condition: selection_component and selection_crash
falsepositives:
  - Unrelated ksmbd bugs or lab fuzzing
  - Driver development / intentional fault injection
fields:
  - message
  - host