Security

KSMBD Exposure Checker

Two critical flaws in KSMBD, the Linux kernel's built-in SMB file server, were disclosed before any fix existed (ZDI-CAN-33774 and ZDI-CAN-33549, CVSS 9.0). Paste the output of the commands below to see if this server is exposed.

Run on the server and paste the outputuname -rlsmod | grep -E '^Module|ksmbd'systemctl is-active ksmbdss -ltn 'sport = :445'ls /sys/class/infiniband
Paste the command output

Paste the output of at least lsmod and systemctl from the list on the left. The checker needs to see whether the ksmbd module is loaded.

Turn KSMBD off until a fix ships

If you don't need KSMBD (most servers use Samba instead), stop it, unload the module and stop it from loading again:

sudo systemctl disable --now ksmbdsudo modprobe -r ksmbdecho 'install ksmbd /bin/false' | sudo tee /etc/modprobe.d/disable-ksmbd.conf

If you must keep it: allow port 445 only from trusted hosts at the firewall, remove guest shares, leave SMB Direct (RDMA) off, and watch your distribution's security tracker for a fixed kernel.

Checked in your browser. What you paste is never uploaded.

A Linux server with a shared folder and a padlock on a network port, behind a shield

How to use

  1. On the server, run the five commands shown next to the box (or copy them all at once) and paste the output.
  2. Read the verdict: Exposed, KSMBD is running, Not exposed, or Kernel has no KSMBD.
  3. If KSMBD is running and you don't need it, copy the commands to turn it off and run them as root.
  4. Run the check again to confirm the module is gone, then repeat on every server, VM and appliance image.

What happened

On October 21 and 22, 2026, Trend Micro's Zero Day Initiative sent six Linux kernel bug reports to public mailing lists before any fixes existed. Two of them are in KSMBD, the SMB3 file server built into the kernel, and both are rated CVSS 9.0:

ZDI-CAN-33774 is a race condition in how KSMBD picks the protocol for a new connection. It can be triggered without logging in by anyone who can reach port 445 on a server running KSMBD. ZDI-CAN-33549 is in the SMB Direct (RDMA) path and needs an RDMA network interface, a writable share and a client that uses SMB Direct, which is off by default.

As of October 23, 2026 there was no fix in the mainline kernel for ZDI-CAN-33774, no CVE numbers had been assigned, and no attacks in the wild had been reported. A fix for ZDI-CAN-33549 had been submitted for a later kernel release.

Who is affected

Only servers where KSMBD is actually running. KSMBD has been in the kernel since Linux 5.15, but it is a module that stays off unless you install ksmbd-tools and start the ksmbd service. Samba, the usual Linux file server, is a separate program and is not affected. Red Hat Enterprise Linux does not ship KSMBD, and most desktop systems never load it.

Small NAS boxes, routers and appliances are worth a look: some use KSMBD for speed. If you can't log in to check, ask the vendor.

How to check a server

A terminal window and a server, with a magnifying glass over a folder icon

lsmod shows whether the ksmbd module is loaded and systemctl is-active ksmbd shows whether the service runs. ss -ltn 'sport = :445' lists anything listening on the SMB port, and /sys/class/infiniband lists RDMA devices (hardware cards, or the rxe software driver). The checker reads all of these from the pasted text.

How to turn KSMBD off

A server with a power plug pulled out of a network port and a shield beside it

Stop and disable the service, unload the module, and add a modprobe rule so it can't load again at boot. Then run the check again. If you need SMB file sharing, Samba can usually take over the same shares.

If KSMBD has to stay, allow TCP 445 only from trusted hosts at the firewall, never from the internet, remove guest-accessible shares, keep SMB Direct off unless you rely on RDMA, and install your distribution's fixed kernel as soon as it is released.

Frequently asked questions

Is Samba affected?

No. Samba runs in user space and is a different code base. These two flaws are in the kernel's KSMBD module only.

Is there a CVE number?

Not yet. The Linux kernel project assigns CVE numbers once a fix has landed in a stable kernel, so the flaws are known by their ZDI numbers for now. This page will add the CVE numbers when they appear.

Does blocking port 445 protect me?

It stops attackers who can't reach the port, which covers ZDI-CAN-33774 from outside your network. Anyone already inside the network can still reach it, so turning KSMBD off is safer.

Is what I paste uploaded?

No. The check runs in your browser and nothing you paste leaves your device.

Share

You might also like