ZDI-26-1004: Linux Kernel KSMBD Request Buffer Use of Uninitialized Resource Information Disclosure Vulnerability
Published Nov 13, 2026
·Updated
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. The ZDI has assigned a CVSS rating of 6.3.
Affected Software
1 affected component
Linux Linux Kernel KSMBD
Event History
Nov 13, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Which systems are exposed to this issue?
Only Linux systems with the KSMBD service enabled are vulnerable. Systems where KSMBD is not enabled are not affected according to the available information.
2
Does an attacker need credentials or prior access?
No. The vulnerability can be exploited remotely without authentication.
3
What is the likely impact of successful exploitation?
A remote attacker may disclose sensitive information from an affected Linux Kernel KSMBD installation.