October 22, 2026 · cybersecurity news today

Cybersecurity News Today: Two CVSS 9.0 RCE Flaws in the Linux Kernel's KSMBD Server, With No Patch Yet

The hardest story in cybersecurity news today is one you cannot patch. KSMBD is the SMB file server built into the Linux kernel itself, and on October 21 and 22, 2026, Trend Micro's Zero Day Initiative published two remote code execution flaws in it, each rated CVSS 9.0, on the public kernel mailing lists before any fix existed. One of them, ZDI-CAN-33774, needs no authentication at all: any host that can reach TCP port 445 can trigger it. Neither flaw has a CVE number yet, and no fixed kernel is available. Until one is, exposure control is the whole defense. The checker below takes a minute.

Update, October 22, 2026: the same week put AI on both sides of infrastructure defense. TrendAI, Trend Micro's AI scanner, is credited among the finders of the two KSMBD flaws above. Meanwhile a study by cybersecurity firm Frenos, published October 21, found that frontier AI models produced workable plans for attacks on industrial control systems in about 90 percent of attempts when given target background information. Defenders are getting AI help finding the holes; attackers are getting AI help planning through them. Our AI ICS attack-plan check covers what the Frenos study did and did not show, with an exposure self-check for small operators.

The two flaws, exactly as disclosed

• ZDI-CAN-33774, the unauthenticated race: a race condition in how KSMBD assigns its protocol handler table. A burst of short SMB1 packets followed by an SMB2 packet in the same TCP write makes worker threads process SMB1 data with an SMB2 handler, reading past the end of the shorter buffer. A path to writing past the buffer also exists once an attacker has access to a share. The trigger needs no authentication and is reachable on any server running KSMBD on TCP port 445.
• ZDI-CAN-33549, the SMB Direct underflow: an integer underflow in KSMBD's SMB Direct path. A client can supply RDMA buffer descriptors in which the first descriptor is longer than the declared payload, which wraps the server's size counter so a subsequent memory copy overruns the end of its buffer. This one needs three things in place: an RDMA-capable interface (hardware, or the rxe software driver), a writable KSMBD share, and a client that negotiates SMB Direct.
• Why kernel space raises the stakes: KSMBD runs inside the kernel, not as a normal application. Memory corruption there carries kernel-level impact, not a crashed file-sharing process.
• Who found them: The Hacker News credits Trend Micro's AI scanner, TrendAI, among the finders. A threat-intel source credits researcher Hyeontae Lee, working with ZDI and TrendAI, for ZDI-CAN-33549 specifically.

The disclosure order is the sharp edge here. ZDI published both flaws on public mailing lists before a fix existed in mainline or linux-next, which means the technical details are public while the patch is not. Fixes for kernel flaws then have to travel from mainline to the stable trees and out to distribution kernels, a trip that typically takes weeks. Every KSMBD server that stays reachable in that window is relying on its network position, not on a patch.

Why this cybersecurity news today matters: the disclosure came before the fix

Most critical flaws arrive with a patch attached, and the race is about who updates first. This pair inverts that: the details are out, the CVE numbers do not exist yet, and there is nothing to update to. That changes the defender's job from patch management to exposure management. The only questions that matter this week are whether the ksmbd module is loaded, whether port 445 can be reached by hosts you do not trust, and whether SMB Direct widens the second flaw's path.

It also lands in a week that keeps widening. The PHP runtime, Node.js, and GitLab all took critical flaws in the same few days, and the finders keep crediting AI tooling: TrendAI is named on this disclosure, just as AI models were credited on the PHP flaws. Whether or not that pattern holds, the practical effect for server operators is the same: flaw details now travel faster than fixes do, and quiet, correctly firewalled services are worth more than they were.

What can you do about the KSMBD flaws today?

You cannot patch yet, because no fixed kernel exists, so the work today is exposure control. Find out whether the ksmbd module is loaded, close or firewall TCP port 445 so only trusted hosts can reach it, turn off SMB Direct, tighten writable shares, and apply your distribution's kernel update the day the fix lands.

Check your KSMBD exposure in under a minute

Run the KSMBD lockdown now

1. Find out whether KSMBD is even loaded: run lsmod | grep ksmbd on the server. If nothing comes back and you serve files with Samba (smbd) instead, these flaws do not apply to that machine. Check every Linux server, not just the one you think of as the file server: KSMBD is a kernel module and can be enabled quietly.
2. If KSMBD is unused, stop and disable it today: unload the ksmbd module and blacklist it, so it does not come back at boot. An unused kernel file server is pure exposure.
3. Firewall TCP port 445 to trusted hosts only: the unauthenticated flaw needs nothing but reachability. If 445 is open to the internet, closing it down is the single highest-value move on this page, and it works today, patch or no patch.
4. Disable SMB Direct: if you do not run RDMA, confirm the rxe driver and the RDMA stack are not loaded. If you do run RDMA, weigh turning SMB Direct off until the fix lands; it is one of the three conditions the second flaw needs.
5. Tighten writable shares: remove guest writes and broad-group writes. Keep writable shares limited to named users who need them, or make shares read-only for the duration.
6. Watch for the fix, then move the day it lands: follow your distribution's kernel security announcements. Remember the chain: mainline first, then stable, then your distribution, which typically takes weeks. When the fixed kernel arrives, install it, reboot into it, and confirm KSMBD is the patched build before you loosen any of the controls above.

BreachHunter, Ingenious AI's external exposure hunter, exists for exactly this gap: a critical flaw with public details and no patch, where the only question that matters is whether your own servers are reachable from outside. It sweeps your public footprint for the ports and services that should not be answering. Get early access on WhatsApp.

Quiz: how well do you know the KSMBD flaws?

Frequently asked questions

Sources: The Hacker News, October 22, 2026 (the two flaws, their triggers and requirements, the mailing-list disclosure before fixes, the missing CVE identifiers, and the TrendAI finder credit) · Trend Micro Zero Day Initiative disclosures for ZDI-CAN-33774 and ZDI-CAN-33549, as published on the public kernel mailing lists, October 21 to 22, 2026 · Phoronix, October 2026 (the reported, still unconfirmed SMB Direct fix submitted by Stefan Metzmacher for the next kernel cycle).