ZDI-CAN-32436: ZDI-26-1004: Linux Kernel KSMBD Request Buffer Use of Uninitialized Resource Information Disclosure Vulnerability
Published Nov 13, 2026
·Updated
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. The ZDI has assigned a CVSS rating of 6.3.
Event History
Nov 13, 2026
Advisory Published
via ZDI·06:00 AM
Data Sourced
via ZDI·06:00 AM
Description
Frequently Asked Questions
1
Which systems are exposed to this issue?
Only Linux Kernel installations with ksmbd enabled are vulnerable. Systems where ksmbd is not enabled are not affected according to the available information.
2
Does an attacker need credentials or prior access?
No authentication is required. A remote attacker can exploit the issue to disclose sensitive information on an affected system.