Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Linux servers running KSMBD, the kernel’s built-in SMB server, are exposed to two publicly reported remote code execution flaws rated CVSS 9.0 by Trend Micro’s Zero Day Initiative, with no fix yet in the mainline kernel, The Hacker News reports. One flaw, ZDI-CAN-33774, can be triggered before any network authentication, while the other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network.