Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

Two remote code execution flaws in the Linux kernel's KSMBD SMB server have been publicly disclosed, each with a CVSS score of 9.0. These vulnerabilities expose Linux servers to potential attacks. One flaw can be triggered without any network authentication, while the other requires SMB Direct transport and an RDMA-capable network. The issues have been reported to public mailing lists, but a fix has not yet been implemented in the mainline kernel. The disclosed flaws have been assigned identifiers ZDI-CAN-33774 and ZDI-CAN-33549 by Trend Micro's Zero Day Initiative.