Linux KSMBD RCE Flaws. Disable. Restrict. Watch.
Two remote code execution flaws in KSMBD, the in-kernel Linux SMB server, have no CVEs or fixes yet. Clear steps for businesses, internal IT teams and MSPs running NAS devices and appliances.
At a Glance
Facts from public reporting and the kernel mailing list. Not reported exploited and not on the CISA KEV catalog as of 22 October 2026, 20:17 BST. Last updated 22 October 2026, 20:45 BST.
No CVE, no fix
Tracked as ZDI-CAN-33774 and ZDI-CAN-33549, both CVSS 9.0. No CVEs or kernel fixes yet.
No login needed
Needs only network access to port 445.
SMB Direct and writable share
Needs SMB Direct over RDMA plus a writable share.
Not reported exploited
Not reported exploited and not on CISA KEV as of 22 October 2026, 20:17 BST.
Two KSMBD flaws reported by security researchers, CVSS 9.0 each.
No CVEs or fixes. Not reported exploited, not on CISA KEV.
Find KSMBD, disable it where not needed and keep port 445 off the internet.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Tick both tracks.
Find and disable
- Check Linux servers, NAS devices and appliances for the ksmbd module.
- If it is not needed, stop it and blacklist the module.
- Never expose port 445 to the internet.
- Disable SMB Direct (RDMA) where not needed.
Watch for attacks
- Watch kernel logs for ksmbd oopses and panics.
- Investigate unexpected reboots of SMB hosts.
- Review firewall logs for inbound 445 from untrusted networks.
- If you find signs: isolate, preserve logs, run incident response.
Proactive: Find and Disable KSMBD
KSMBD is not Samba. It is mostly found on NAS and appliance builds. Samba-only systems are not affected by these flaws.
Check for KSMBD
On each Linux host run:
lsmod | grep ksmbd
systemctl status ksmbd 2>/dev/nullFor NAS devices and appliances, check the vendor documentation or ask the vendor whether the SMB service uses KSMBD.
Stop and blacklist if not needed
sudo systemctl stop ksmbd 2>/dev/null; sudo ksmbd.control -s 2>/dev/null
sudo modprobe -r ksmbd
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/disable-ksmbd.confRestrict port 445
Never expose port 445 to the internet. Limit SMB to trusted internal networks, and disable SMB Direct over RDMA unless you need it. Apply kernel or firmware updates as soon as fixes are released.
Free Checker Scripts
Built by the CybaVerse threat hunt team. Run it on Linux servers and appliances where you have a shell to see whether KSMBD is running and reachable.
check_ksmbd.sh
Checks whether the ksmbd module is loaded, ksmbd.mountd is running, TCP 445 is listening and the module is blacklisted, and flags RDMA indicators relevant to ZDI-CAN-33549. Read-only, with no SMB traffic sent.
sudo bash check_ksmbd.shPATCHED does not mean a fixed kernel. There is no patch or CVE yet. PATCHED only means KSMBD is not present or is mitigated (not loaded, not running, or blacklisted).
Read-only by design
The checker only reads module, process and listening port state. It never sends SMB traffic or changes the host. Stopping and blacklisting KSMBD stay with you. Review any script before you run it.
Verdicts
- PATCHEDKSMBD not present or mitigated: module not loaded, mountd not running, or blacklisted. This is not a fixed kernel, because no patch exists yet.
- LIKELY VULNERABLEKSMBD loaded or running and TCP 445 listening. Stop and blacklist it, or restrict 445 now.
- UNKNOWNPartial visibility, for example the 445 listener owner is unclear.
- ERRORThe check failed, so the result is unknown.
Exit codes
| Code | Meaning |
|---|---|
| 0 | PATCHED (not present or mitigated) |
| 1 | LIKELY VULNERABLE |
| 2 | UNKNOWN |
| 3 | ERROR |
MSPs and internal IT teams can use the exit code in RMM or deployment tooling to flag hosts at scale.
Know the limits
- PATCHED means KSMBD is not present or is mitigated. No kernel patch or CVE exists yet.
- Closed NAS and appliance builds may not give you a shell. Ask the vendor whether the SMB service uses KSMBD.
- The KQL has not been run on a live tenant and the checker was tested against fixtures only.
Reactive: How to Hunt
With no fix yet, monitoring matters. CybaOps can watch your estate or your clients'.
Kernel oopses and panics
journalctl -k | grep -iE "ksmbd|oops|panic|BUG:"Unexpected reboots
Investigate unexpected reboots or crashes on hosts running KSMBD.
last -x reboot | headInbound SMB
Review firewall and flow logs for inbound connections to port 445 from untrusted networks. If you find signs of attack, isolate the host, preserve logs and run incident response.
Detection pack: KQL and Sigma
Hunts from the CybaVerse threat hunt team for Microsoft Sentinel and Defender XDR: ksmbd kernel oopses in Syslog and unexpected inbound TCP 445 to Linux hosts, plus a Sigma rule for ksmbd oops lines. Run them in CybaOps or your own SIEM.
There are no published IOCs, so these hunts are behaviour-based. The KQL has not been run on a live tenant. Adjust the Linux device filter for your environment.
KQL hunting queries (Sentinel and Defender XDR)
Loading queries. If they don't appear, download the full pack below. The .kql file is inside it.Sigma: ksmbd-related kernel oops
title: KSMBD Kernel Oops BUG or KASAN in Syslog
id: 5d9a1c2e-77b4-4f0a-8c3d-1e9b6a0f2d48
status: experimental
description: >
Detects Linux kernel log lines that reference ksmbd (or related smb2pdu /
smbdirect symbols) together with oops, BUG, KASAN, or panic markers. Useful
as a reactive signal around ZDI-CAN-33774 / ZDI-CAN-33549 disclosures
(CVSS 9.0 KSMBD RCE class issues; no CVE at time of writing). Presence of an
oops is not proof of exploitation.
references:
- https://lore.kernel.org/lkml/
author: detection-pack
date: 2026-10-22
level: high
tags:
- attack.impact
- attack.t1203
logsource:
product: linux
service: syslog
detection:
selection_component:
message|contains:
- 'ksmbd'
- 'smb2pdu'
- 'smbdirect'
selection_crash:
message|contains:
- 'BUG:'
- 'Oops'
- 'KASAN'
- 'kernel BUG'
- 'slab-out-of-bounds'
- 'Unable to handle'
- 'panic'
condition: selection_component and selection_crash
falsepositives:
- Unrelated ksmbd bugs or lab fuzzing
- Driver development / intentional fault injection
fields:
- message
- hostKSMBD FAQ
Short answers as of 22 October 2026.
Is Samba affected?
These flaws are in KSMBD, the in-kernel SMB server, not Samba.
Is there a fix?
Not yet. There are no CVEs or kernel fixes as of 22 October 2026. Disable KSMBD where not needed and restrict port 445.
Is it being exploited?
It is not reported exploited and is not on CISA KEV as of 22 October 2026, 20:17 BST.
Detect and Remediate KSMBD Exposure Across Your Estate
CybaOps monitors your endpoints, servers and applications, whether that's your own business or your clients'. Our SOC runs these threat hunts, alerts on suspicious activity and drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.