Linux systems utilizing KSMBD, the kernel's integrated SMB server, are currently at risk due to two severe remote code execution vulnerabilities. Rated 9.0 by Trend Micro's Zero Day Initiative, these flaws have been disclosed publicly without a resolution in the primary kernel. The vulnerabilities, identified as ZDI-CAN-33774 and ZDI-CAN-33549, pose significant threats to Linux SMB services.

ZDI-CAN-33774 represents a critical flaw as it can be exploited without any network authentication, affecting servers running KSMBD on port 445. This vulnerability arises from a race condition in the handler table assignment process. An attacker can manipulate a series of short SMB1 packets followed by an SMB2 packet in the same TCP write, causing an SMB1 data handler to read beyond the intended buffer, potentially leading to a memory overwrite.

On the other hand, ZDI-CAN-33549 requires an RDMA-capable network interface and the SMB Direct transport. This flaw is due to an integer underflow in the SMB Direct path, where a client can send RDMA buffer descriptors with the first longer than the declared payload. This results in a size counter wrap, leading to a memory copy that overruns the allocated buffer.

Currently, no official fixes have been integrated into the mainline kernel. While a patch targeting ZDI-CAN-33549 has been proposed for the next development cycle, it remains unconfirmed. It's important to note that neither vulnerability has been assigned a CVE identifier yet, as the process requires a stable-tree fix first.

Administrators can verify if the KSMBD module is active using systemctl status ksmbd or lsmod | grep ksmbd. Red Hat Enterprise Linux users are less affected since KSMBD is not included by default. The vulnerabilities were discovered by TrendAI, Trend Micro's AI scanner, and publicly reported in accordance with the Linux kernel's updated security guidelines.