Two CVSS 9.0 Pre-Patch KSMBD RCE Flaws Disclosed Publicly

Sat, 24 Oct 2026 14:29:02 +0000

Engineer — Act: A pre-authentication RCE (ZDI-CAN-33774) in the Linux kernel’s built-in SMB server is publicly disclosed with no mainline fix yet. Audit all Linux servers for ksmbd running (lsmod | grep ksmbd), disable the service where SMB is not required, and firewall SMB ports (445/TCP) at the network edge until a kernel patch is available.
SOC/IR — Plan: No active exploitation or IOCs reported yet, but public mailing-list disclosure of a pre-auth RCE raises the PoC timeline. Identify estate assets running ksmbd, and build detections for anomalous inbound SMB traffic to Linux hosts before a working exploit emerges.
Leader — Skip

Ksmbd on CuraSec