News › security
By The Linux Camp News, October 22, 2026
ZDI's October 21 report describes broken buffer accounting in KSMBD's SMB Direct path. Its reproduction shows a kernel out-of-bounds write, while a proposed development-branch fix remains unvalidated in the supplied record.
On October 21, 2026, at 21:16 UTC, Trend Micro's Zero Day Initiative publicly disclosed ZDI-CAN-33549, an integer-underflow report concerning Linux KSMBD's SMB Direct path. The message copied the public Linux kernel mailing list. This establishes a public disclosure date, not when the vulnerability was discovered. The operational scope described by the report is KSMBD with SMB Direct, not Linux installations generally. 2 1
The failure is in remaining-buffer accounting inside smbdirect_connection_rdma_xmit(). When a descriptor requests more bytes than remain, the function reduces its length to fit and sets buf_len to zero. It then subtracts that nonzero length from buf_len anyway. Because the counter is unsigned, subtraction below zero wraps to a large positive value: an integer underflow. The next iteration can therefore see apparent space rather than an exhausted buffer. ZDI links this error to a heap overflow in rxe_mr_copy(), where data is copied beyond allocated memory. 2 3
In the report retrieved October 22, ZDI classifies the issue as remote code execution and assigns CVSS 9.0. That is ZDI's severity assessment, not proof of successful code execution. The supplied KASAN memory-checking diagnostic records an out-of-bounds write of 1,024 bytes in rxe_mr_copy(). It supports a kernel-memory corruption finding, but does not by itself establish attacker-controlled execution or exploitation in the wild. 2 3
For operator triage, the report's prerequisites provide a configuration checklist: KSMBD SMB Direct support, an RDMA device and a writable share. ZDI tested 7.3-rc3 with CONFIG_SMB_SERVER_SMBDIRECT=y and CONFIG_RDMA_RXE=y. The practical inference is to prioritize deployments matching those conditions, rather than treating every Linux host as exposed. Check the deployed service and kernel configuration against that checklist; the tested version is a reproduction target, not a complete affected-version range. 2
The reproduction requirements also contain an unresolved platform qualification: they say “smb direct (ubuntu only)” while the tested platform is labeled Debian trixie. That inconsistency prevents using the report as an Ubuntu-only exposure verdict. Systems without SMB Direct fall outside its stated reproduction conditions, but the supplied material does not establish a comprehensive unaffected-build list. 2
Fix status remained provisional in the sources retrieved October 22. Stefan Metzmacher asked for testing against his for-7.5/smbdirect development branch, expressing a tentative belief that it already fixed the problem. That request is not a validated fix or a released update. Phoronix reported that mainline remained unpatched; the supplied exchange contains no subsequent test result or confirmed stable backport. Operators therefore cannot derive a fixed-package recommendation from this branch reference alone. 3 1
The public posting should not be described as a confirmed accidental leak. Phoronix characterized the apparent mistake tentatively, and the supplied sources provide no explanation from ZDI establishing its intent. Public disclosure is documented; the reason for choosing public recipients remains unresolved. 1