VulnHub

Real-time Cybersecurity News

Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes

The Hacker News
LinuxExploitVulnerabilityRCETrend Micro

Overview

Two serious vulnerabilities have been discovered in KSMBD, the SMB server built into the Linux kernel, both rated 9.0 for severity. The first vulnerability, identified as ZDI-CAN-33774, allows attackers to execute code remotely without needing network authentication. The second flaw, ZDI-CAN-33549, requires specific network configurations, including SMB Direct transport and an RDMA-capable network. As of now, there are no fixes available in the mainline kernel, leaving Linux servers vulnerable to potential attacks. This situation poses a significant risk to organizations using affected Linux distributions, as attackers could exploit these flaws to gain unauthorized access and control over systems.

Key Takeaways

  • Affected Systems: Linux servers running KSMBD
  • Action Required: No fixes available in the mainline kernel; users should monitor for updates and consider disabling KSMBD if possible.
  • Timeline: Newly disclosed

Original Article Summary

Linux servers running KSMBD, the kernel's built-in SMB server, are exposed to two publicly reported remote code execution flaws rated 9.0 by Trend Micro's Zero Day Initiative, with no fix yet in the mainline kernel. One of them, ZDI-CAN-33774, can be triggered before any network authentication. The other, ZDI-CAN-33549, requires the SMB Direct transport and an RDMA-capable network

Impact

Linux servers running KSMBD

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

No fixes available in the mainline kernel; users should monitor for updates and consider disabling KSMBD if possible.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, Exploit, Vulnerability, and 2 more.

Read Original Article

Related Coverage

Railway warns devs to rotate secrets after potential breach

BleepingComputer

Railway, a cloud platform, alerted its users about suspicious activity detected in its systems that manage customer environment variables. This warning came earlier this week and has raised concerns regarding the potential exposure of sensitive information. Users are advised to take immediate action by rotating their secrets to minimize the risk of unauthorized access. The incident serves as a reminder for developers and organizations to regularly update and secure their credentials, especially when using cloud services. Failure to do so could lead to data breaches or exploitation of compromised systems.

Oct 22, 2026

Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour

darkreading

Hundreds of supermarkets across the EU have faced significant financial losses, totaling millions of euros, due to outdated firmware in their refrigeration systems. These firms had outsourced the management of their operational technology (OT) firmware, which was not kept up to date. As a result, the outdated systems led to failures in climate control, affecting perishable goods and overall store operations. This incident underscores the risks associated with neglecting firmware updates, especially when relying on third parties for system management. Businesses need to prioritize regular updates to their technology to avoid similar costly disruptions in the future.

Oct 22, 2026

LiteLLM release pipeline hacked to distribute info-stealer malware

BleepingComputer

Hackers have infiltrated the LiteLLM project's repository on PyPI, the Python Package Index, to distribute malicious Docker images. These images contain an information-stealer malware that targets credentials, secrets, and environment variables from affected systems. Developers and users who downloaded these compromised packages are at risk of having sensitive information stolen. This incident underscores the need for vigilance when using third-party packages, especially in open-source projects. Users should ensure they are using trusted sources and verify the integrity of the software they download.

Oct 22, 2026

Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks

The Hacker News

Arista has issued a warning about a serious SQL injection vulnerability in its VeloCloud Orchestrator (VCO), which is used to manage VeloCloud SD-WAN networks. This flaw allows attackers to escalate privileges to operator level, even if they only have a read-only customer account. The company reported that this vulnerability is actively being exploited in attacks, posing significant risks to organizations using VCO for network management. Users of the VeloCloud Orchestrator need to take immediate action to secure their systems, as the exploitation could allow unauthorized access and control over sensitive network configurations. Organizations should be vigilant and check for any suspicious activity in their networks.

Oct 22, 2026

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

The Hacker News

eMudhra, an Indian certificate authority, has decided to exit the global SSL/TLS certificate market after a researcher discovered that the private keys for eight of its intermediate CA certificates were easily guessable. This vulnerability raises significant security concerns, as it potentially allows attackers to impersonate websites or intercept secure communications. Affected customers will be provided with free replacements from eMudhra's partners. The incident highlights the importance of strong cryptographic practices in the certificate authority industry, as the integrity of SSL/TLS certificates is crucial for secure online transactions and communications. The company’s withdrawal from this space may leave customers seeking new providers for their digital certificate needs.

Oct 22, 2026

Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

BleepingComputer

Arista Networks has issued security updates to address a zero-day vulnerability in the VeloCloud Orchestrator (VCO) used for on-premises deployments. This vulnerability is currently being exploited in the wild, which raises significant concerns for organizations relying on this software. Attackers could potentially gain unauthorized access to sensitive data or disrupt network operations. Companies using VeloCloud Orchestrator should act quickly to implement the patches released by Arista to mitigate any risk. The situation emphasizes the importance of keeping software up to date and monitoring for vulnerabilities.

Oct 22, 2026