Five unpatched vulnerabilities in the Linux kernel became visible to anyone browsing the public developer mailing lists after Trend Micro's Zero Day Initiative copied them in while reporting the bugs on October 21, 2026. Two of the flaws hit ksmbd, the kernel's built-in SMB file-sharing server, and carry a CVSS score of 9.0, with no fix yet in any stable kernel release as of October 23.
What ksmbd is and why a bug there matters more
ksmbd is the Linux kernel's own implementation of SMB, the protocol Windows machines and many NAS devices use to share folders over a network. Unlike Samba, which runs as an ordinary background program, ksmbd runs inside the kernel itself, so a serious bug there can hand an attacker control over the whole machine rather than just one process. Most desktop distributions, including Ubuntu and Fedora, don't enable it by default, and Red Hat has confirmed since 2022 that it doesn't ship ksmbd in its products at all. The people actually exposed are those running homemade NAS boxes or lightweight file servers who chose ksmbd specifically because it outperforms Samba, and who had to install ksmbd-tools and start the service manually to use it.
The two most serious bugs
The worst of the five, internally labeled ZDI-CAN-33774, is a race condition in how ksmbd dispatches SMB requests. According to people who have read the reports, it can reportedly be triggered before a client even authenticates, meaning simply reaching port 445 on a machine running ksmbd may be enough. The second, ZDI-CAN-33549, is an integer underflow in the SMB Direct path and requires tighter conditions: a network card with RDMA support, a writable ksmbd share, and a client that negotiates SMB Direct. Neither flaw has been assigned a CVE code yet, and the 9.0 and 7.8 severity scores come from ZDI's own assessment, not an independent review, so the real-world risk could shift once kernel maintainers examine the exact attack conditions.
Why the disclosure happened this way
Greg Kroah-Hartman, who maintains the stable kernel branches, publicly objected that the reports were sent to open mailing lists without an accompanying patch, and asked ZDI to revise its process. But the kernel's own documented security policy states that a bug discovered with the help of artificial intelligence should be treated as effectively public, since multiple researchers using similar tools are likely to find the same issue independently. Cybersecurity News reported that the ZDI submissions credit the discovery to Trend Micro's AI-based scanner, which may explain the handling, though ZDI has not issued a public explanation as of October 23. A fix for the ksmbd race condition already sits in maintainer Namjae Jeon's development branch, and another kernel developer believes the SMB Direct issue is already resolved in code being prepared for the upcoming Linux 7.5, but neither has reached a released, patched kernel yet.
What server operators should do now
Anyone unsure whether they're affected can check if the ksmbd module is loaded and whether anything is listening on port 445; if not, the two most serious flaws don't apply. For those who do rely on ksmbd, keeping port 445 closed to untrusted networks, especially the open internet, meaningfully shrinks the attack surface while waiting for a distribution's kernel package to incorporate the fix. No active exploitation has been reported as of October 23, but the technical descriptions have now been public for two days, giving anyone interested a clear starting point.