Linux kernel Kernel Linux: ksmbd · Public exploit code

Public root exploit reported in Linux kernel; no mainline fix yet

Oct 20, 2026 · 1 min read

Trend Micro's Zero Day Initiative accidentally posted six Linux kernel vulnerability reports to the public LKML list, including a local privilege escalation to root (ZDI-CAN-33367, CVSS 7.8) and two CVSS 9.0 RCEs in ksmbd. A report says a public root exploit exists for one of the flaws, and no mainline or stable kernel is fixed. Apply the KernelCare livepatch (CloudLinux 10 and AlmaLinux 10) or the AlmaLinux testing backports until the upstream fix merges.

By HIFY Radar newsroom Updated 10/26/2026 01:44 PM Get this every day →← Back to the feed 9 sources

HighVulnerabilityPublic exploit codeUnpatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Trend Micro's Zero Day Initiative accidentally posted six Linux kernel vulnerability reports to the public kernel mailing list (LKML). They include a local privilege escalation to root and two CVSS 9.0 remote code execution flaws in the in-kernel SMB server (ksmbd). A report says a public root exploit exists for one of the flaws, and no mainline or stable kernel is fixed.

Why it matters

The privilege escalation lets an attacker with local access or a low-privilege account take an entire server as root. The ksmbd flaws expose servers with the in-kernel SMB server loaded and serving shares. With no kernel fix available, every affected Linux server runs with a known, publicly detailed flaw.

What to do

Apply the KernelCare livepatch (CloudLinux 10 and AlmaLinux 10) or the AlmaLinux backports in the almalinux-testing repo (8: 4.18.0-553.177.2.el8_10; 9: 5.14.0-687.59.2.el9_8; 10: 6.12.0-211.68.2.el10_2). Check whether the ksmbd module is loaded and disable it if unused. Track the upstream fix merge and tighten local access controls.

For the technical team

Affected: Linux kernel Kernel Linux: ksmbd (servidor SMB in-kernel) e SMB Direct, skbuff/NFQUEUE, vmwgfx, nvmet · Linux kernel; reports tested on Linux 7.3-rc1 and 7.3-rc3 (Debian trixie); first affected versions not published. Components: ksmbd and SMB Direct, skbuff/NFQUEUE, vmwgfx, nvmet.
Exploitation: PoC stage: a report says a public root exploit exists for one of the six flaws. Phoronix reports the ZDI reports were accidentally posted to the public LKML instead of the private security list. No mass exploitation mentioned in the sources.
Fix: No fixed mainline or stable kernel. skb_zerocopy fix (ZDI-CAN-33367) posted for upstream review, not merged. ksmbd race (ZDI-CAN-33774): fix commit 68f410faedaf in the maintainer tree (linkinjeon/smb.git), not yet in a release. SMB Direct (ZDI-CAN-33549): likely fixed in Stefan Metzmacher's for-7.5/smbdirect branch (unconfirmed). KernelCare livepatch released for CloudLinux 10 and AlmaLinux 10 only (9 in review, 8 in progress). AlmaLinux backports in the almalinux-testing repo, not in production repos: 8: 4.18.0-553.177.2.el8_10, 9: 5.14.0-687.59.2.el9_8, 10: 6.12.0-211.68.2.el10_2. No fixed RHEL kernel yet.
Vector: Multiple components: skbuff skb_zerocopy (network/NFQUEUE) local privilege escalation to root (ZDI-CAN-33367, CVSS 7.8); ksmbd in-kernel SMB server RCE via protocol dispatch race condition (ZDI-CAN-33774) and SMB Direct integer underflow RCE (ZDI-CAN-33549), both CVSS 9.0; vmwgfx dirty tracking out-of-bounds write LPE (ZDI-CAN-34068); nvmet Get Log Page uninitialized resource info disclosure (ZDI-CAN-34076). The ksmbd RCEs require the in-kernel SMB server loaded and serving shares; the SMB Direct bug requires an RDMA device and CONFIG_SMB_SERVER_SMBDIRECT.
More details: ZDI (Trend Micro Zero Day Initiative) sent the reports to LKML by mistake; Greg Kroah-Hartman replied to each report asking about the public submission, per Phoronix. Phoronix also lists ZDI-CAN-32005 (search-domain TCP query stack buffer overflow, LPE), posted a day earlier. Kernel developers had received a report from another source the prior week about the same skb_zerocopy issue, with a patch expected soon. Phoronix piece dated 22 October 2026; CloudLinux blog lists start 2026-10-21.

Timeline

10/26/2026 01:44 PM
Report says a working root exploit is now public for one of the six flaws, still without a kernel fix.
10/26/2026 01:17 PM
ZDI discloses a local LPE without a mainline fix; live patch limited to CloudLinux 10 and AlmaLinux 10.