Linux ksmbd: critical in-kernel SMB server flaws, some unpatched

Two new unpatched flaws and a long series of fixed ones

ksmbd is an SMB file server built into the Linux kernel. It is a lighter alternative to Samba, but all its code handling traffic on port 445 runs inside the kernel, so any memory bug there can let a network attacker take over the whole system.

Overnight on 21–22 October, the Zero Day Initiative (Trend Micro) sent reports on several unpatched flaws to the public kernel mailing list instead of the private security list. Two of them affect ksmbd and carry a CVSS score of 9.0:

• ZDI-CAN-33774: a race in connection handling. A second request switches the connection from SMB1 to SMB2 while an earlier SMB1 buffer is still waiting to be processed, and the SMB2 code reads past its end. The CVSS vector requires no privileges, but the attacker has to win the race.
• ZDI-CAN-33549: an integer underflow in SMB Direct, i.e. SMB over RDMA. It matters only where the server has an RDMA-capable network card and SMB Direct enabled.

As of 22 October, neither has a fix in the mainline kernel or a CVE number. The SMB Direct fix is waiting in a development branch. Kernel CVE numbers are assigned only after a fix ships.

Since August, dozens of CVEs have also been published for ksmbd. Two already fixed ones are worth knowing:

• CVE-2026-72422: a use-after-free triggered by two SMB2 NEGOTIATE requests on a single connection. This happens before login, so no account is needed. CISA scored it 9.8 in NVD.
• CVE-2026-89788: a use-after-free in smb2_tree_connect() during a concurrent session logoff. It requires an SMB session, meaning an account or guest access. CISA also scored it 9.8.

None of these flaws is in the CISA KEV catalogue and there are no reports of attacks. Still, the public description of the two new bugs makes writing an exploit easier.

Who actually runs ksmbd

Most Linux file servers in companies use Samba, which runs in user space and does not have these flaws. Red Hat does not ship ksmbd in RHEL or in UBI images. Ubuntu and Debian build ksmbd as a kernel module, but the module does not start on its own: it needs the ksmbd-tools package and configured shares. The risk applies to those who chose ksmbd deliberately: routers and home NAS boxes running OpenWrt (the ksmbd-server and luci-app-ksmbd packages), small file servers set up in a hurry in labs, and embedded devices whose vendor picked ksmbd for its lower resource use. For off-the-shelf NAS devices, check the vendor's documentation.

How to check whether ksmbd is running

• lsmod | grep ksmbd: whether the module is loaded.
• systemctl status ksmbd: whether the service from ksmbd-tools is running.
• grep SMB_SERVER /boot/config-$(uname -r): whether the kernel includes ksmbd (CONFIG_SMB_SERVER) and SMB Direct (CONFIG_SMB_SERVER_SMBDIRECT).
• ss -ltnp | grep ':445': port 445 listening without a process name usually means an in-kernel server; Samba shows up as smbd.
• On OpenWrt: opkg list-installed | grep ksmbd.

What to do now and what can wait for a maintenance window

If you do not need ksmbd, disable it today: systemctl disable --now ksmbd, then modprobe -r ksmbd, and to block reloading, add a file in /etc/modprobe.d/ containing install ksmbd /bin/false. This is the only effective protection against the unpatched flaws.

If ksmbd has to stay:

• Block port 445 on the firewall for everything except trusted subnets. SMB should never be reachable from the internet.
• Disable guest access and SMB1 in ksmbd.conf.
• If you do not use RDMA, SMB Direct is not reachable anyway and ZDI-CAN-33549 does not affect you.
• Install the kernels already available with the CVE-2026-72422 fixes and plan another update once patches for the new bugs appear.

Fixed versions for CVE-2026-72422: kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 and 7.2 and later. In distributions: Ubuntu 24.04 from 6.8.0-147.147, Ubuntu 22.04 from 5.15.0-198.208, Ubuntu 26.04 from 7.0.0-34.34, Debian 12 from 6.1.190-1, Debian 13 from 6.12.113-1. Some Ubuntu variants (HWE 6.17, Raspberry Pi, realtime) were still marked vulnerable on 22 October.

CVE-2026-89788 is fixed in kernels 6.6.160, 6.12.114, 7.2.6 and 7.3. Debian 12 and 13 did not yet have this fix in the security channel, and for the 5.15 and 6.1 branches the CVE record lists no fixed version. After updating, reboot: the old kernel stays in use until restart (uname -r).

The longer-term lesson

An in-kernel file server is tempting for its performance, but the pace of new bugs shows the code is not yet mature. Keep a list of devices exposing SMB on your network, noting whether each runs Samba, ksmbd or a vendor system. Without it, every similar report means searching again for open port 445.