ZDI-26-998: Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication may or may not be required to exploit this vulnerability, depending upon configuration. Only systems with SMB Direct enabled are vulnerable. The ZDI has assigned a CVSS rating of 9.0.

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

Which systems are exposed to this vulnerability?

Only affected Linux Kernel KSMBD installations with SMB Direct enabled are vulnerable. Systems without SMB Direct enabled are not affected by this issue.

Does an attacker need valid credentials to exploit this issue?

Authentication requirements depend on the system configuration. The available information indicates that exploitation may be possible with or without authentication.

What impact could successful exploitation have?

A remote attacker could execute arbitrary code on an affected installation.

ZDI-26-998: Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability

Event History

Frequently Asked Questions

Which systems are exposed to this vulnerability?

Does an attacker need valid credentials to exploit this issue?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this vulnerability?

Does an attacker need valid credentials to exploit this issue?

What impact could successful exploitation have?