Re: ZDI-CAN-33774: New Vulnerability Report

[Namjae Jeon]

On Thu, Oct 22, 2026 at 6:36 AM zdi-disclosures@xxxxxxxxxxxxxx
<zdi-disclosures@xxxxxxxxxxxxxx> wrote:
>
> ZDI-CAN-33774: Linux Kernel KSMBD Protocol Dispatch Race Condition Remote Code Execution Vulnerability
>
> -- CVSS -----------------------------------------
>
> 9.0: AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
>
> -- ABSTRACT -------------------------------------
>
> Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:
> Linux - Kernel KSMBD
>
> -- VULNERABILITY DETAILS ------------------------
> * Version Tested:7.3-rc3
> * Platform Tested:debian trixie
>
> ---
>
> ### Analysis
>
> conn->ops is selected per-PDU at enqueue time but dereferenced at dequeue time.
> It can lead to a 40-byte SMB1 buffer is parsed as a 64-byte SMB2 header without length check and leak OOB read memory back to attacker.
> There is also a path to OOB write, smb2_set_info -> parse_sec_desc.
> The trigger requires race and guest share.
This issue has already been fixed. See:

https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git/commit/?id=68f410faedaf6ee74d81e574733c50ebcc1bd8ed

Thanks.