Two critical remote code execution vulnerabilities with CVSS score 9.0 were publicly disclosed in the Linux kernel’s KSMBD SMB server before fixes were available. One flaw allows unauthenticated attacks via crafted SMB1/SMB2 packet handling, while the other exploits an integer underflow in SMB Direct transport requiring an RDMA interface; neither has a patch in the mainline kernel yet. These issues expose Linux servers running KSMBD to significant risk until mitigations are released and deployed.
https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html