Act
active
Two CVSS 9.0 Pre-Patch KSMBD RCE Flaws Disclosed Publicly
- Engineer — Act: A pre-authentication RCE (ZDI-CAN-33774) in the Linux kernel’s built-in SMB server is publicly disclosed with no mainline fix yet. Audit all Linux servers for ksmbd running (
lsmod | grep ksmbd), disable the service where SMB is not required, and firewall SMB ports (445/TCP) at the network edge until a kernel patch is available. - SOC/IR — Plan: No active exploitation or IOCs reported yet, but public mailing-list disclosure of a pre-auth RCE raises the PoC timeline. Identify estate assets running ksmbd, and build detections for anomalous inbound SMB traffic to Linux hosts before a working exploit emerges.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.