ZDI-CAN-33549: ZDI-26-998: Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication may or may not be required to exploit this vulnerability, depending upon configuration. Only systems with SMB Direct enabled are vulnerable. The ZDI has assigned a CVSS rating of 9.0.

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

Which systems are exposed to this vulnerability?

Only Linux Kernel KSMBD installations with SMB Direct enabled are vulnerable. Systems where SMB Direct is not enabled are not identified as affected by the available information.

Does an attacker need valid credentials?

Authentication requirements depend on the system configuration. The available information indicates that exploitation may be possible either with or without authentication, depending on how the affected KSMBD service is configured.

What is the potential impact of successful exploitation?

A remote attacker could execute arbitrary code on an affected Linux Kernel KSMBD installation. The advisory assigns the issue a CVSS rating of 9.0.

ZDI-CAN-33549: ZDI-26-998: Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability

Event History

Frequently Asked Questions

Which systems are exposed to this vulnerability?

Does an attacker need valid credentials?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this vulnerability?

Does an attacker need valid credentials?

What is the potential impact of successful exploitation?