Affected Systems
Linux KSMBD (kernel SMB server) on all distributions where the module is loaded. ZDI-CAN-33774 affects any KSMBD install on port 445. ZDI-CAN-33549 requires SMB Direct transport with RDMA-capable network hardware or rxe software driver. Red Hat Enterprise Linux does not ship KSMBD by default.
Exploitation Status
Publicly disclosed with technical details on mailing lists. No CVE assigned yet. No confirmed patches in mainline kernel or linux-next as of disclosure. No evidence of active exploitation reported, but ZDI-CAN-33774 requires no authentication and is trivially reachable.
Business Impact
Servers running KSMBD are exposed to unauthenticated remote code execution (ZDI-CAN-33774) or authenticated RCE if SMB Direct is enabled (ZDI-CAN-33549). No stable kernel fixes available yet; patches may take weeks to reach distribution kernels. KSMBD is not widely deployed in enterprise Linux (not in RHEL by default), limiting exposure. Organizations using KSMBD for file sharing face immediate risk with no vendor patch timeline.
Urgency
🔴 Immediate
Recommended Actions
- Check if KSMBD is active using 'systemctl status ksmbd' or 'lsmod | grep ksmbd' on all Linux servers
- Disable KSMBD module immediately if not required for business operations using 'systemctl stop ksmbd' and 'systemctl disable ksmbd'
- If KSMBD is required, restrict port 445 access to trusted networks only via firewall rules until patches are available
- Disable SMB Direct and RDMA on KSMBD shares if ZDI-CAN-33549 is a concern and SMB Direct is not operationally necessary
- Monitor kernel mailing lists and distribution security advisories for patches targeting ZDI-CAN-33774 and ZDI-CAN-33549, and apply immediately when available