Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Two remote code execution vulnerabilities in Linux's built-in SMB server (KSMBD) have been publicly disclosed on mailing lists before mainline kernel patches are available. Both flaws carry a CVSS score of 9.0 and were reported by Trend Micro's Zero Day Initiative. ZDI-CAN-33774 is particularly dangerous as it can be triggered pre-authentication over the network. ZDI-CAN-33549 requires SMB Direct transport and an RDMA-capable network interface. Linux servers with KSMBD enabled are currently exposed with no official fix in the mainline kernel. The public disclosure before patching increases the risk of exploitation by threat actors.