On August 13, 2026, advisory ZDI-26-573 documents a vulnerability in the Linux kernel's KSMBD subsystem that allows an unauthenticated remote attacker to read sensitive information outside the bounds of an allocated buffer. The flaw resides in the init_smb2_rsp_hdr function and affects only systems with KSMBD enabled, the in-kernel SMB server implementation alternative to userspace Samba. Coordinated disclosure occurs exactly 41 days after the vendor report, filed on July 3, 2026.
- Vulnerability ZDI-26-573 is an out-of-bounds read in the
init_smb2_rsp_hdrfunction of the Linux kernel's KSMBD subsystem. - No authentication is required for exploitation: only the condition of KSMBD being enabled exposes the system.
- The attacker obtains information disclosure in kernel context, with potential combination with other vulnerabilities for arbitrary code execution.
- Linux has released a corrective update; CVE and CVSS are not assigned or specified in the ZDI advisory.
Why KSMBD Changes the Attack Surface
KSMBD is the SMB3 protocol implementation maintained directly in the Linux kernel, designed for embedded and NAS scenarios where in-kernel stack performance surpasses userspace Samba. The architectural difference is substantial: where Samba operates in userspace with all Linux memory model protections, KSMBD executes in kernel context.
This means a vulnerability in KSMBD's SMB parser does not translate into an isolatable process crash or user data leak, but into direct access to the kernel address space. The ZDI advisory specifies that the information disclosure obtained through the out-of-bounds read can be combined with other vulnerabilities to execute arbitrary code in kernel context.
The source does not specify which other primitives are needed to complete the escalation, nor does it document the exact nature of the leaked information (kernel structures, memory addresses, credentials).
The Flaw Mechanism: init_smb2_rsp_hdr
The init_smb2_rsp_hdr function handles SMB2 response header initialization in the KSMBD subsystem. According to the ZDI advisory, the lack of adequate validation of user-supplied data permits a read past the end of an allocated buffer.
"The specific flaw exists within the init_smb2_rsp_hdr functions. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer." — ZDI Advisory ZDI-26-573
The attack condition requires no authentication but depends on KSMBD being active on the target system. This combination — network exposure without credential prerequisites and privileged execution context — makes the vulnerability particularly relevant for network storage infrastructures exposed directly or placed in segments with limited access controls.
Timeline and Patch Status
The vulnerability was reported to the Linux vendor on July 3, 2026. Coordinated public advisory release occurred on August 13, 2026, with a 41-day window between report and disclosure. Linux has issued a corrective update, but the ZDI advisory does not indicate the specific commit hash nor the affected kernel versions.
The absence of an assigned CVE and an explicit CVSS score in the advisory must not lead to underestimation: kernel context implies implicit bypass of all userspace protections, and the lack of authentication requirement significantly lowers the barrier to entry for an attacker.
Why It Matters
The dossier does not specify the real-world attack surface of KSMBD in production, nor does it provide adoption metrics for the subsystem versus Samba. The source also does not document whether public exploits exist or if the vulnerability has been observed in-the-wild.
The brief does not list specific remedial measures beyond the update issued by Linux. No indication emerges regarding temporary mitigation controls, KSMBD configurations that limit exposure, or tools for detecting exploitation attempts.
The dossier does not specify the exact nature of the data exposed through the out-of-bounds read, nor the number of bytes readable beyond the allocated buffer.
Reading: The Risk of In-Kernel Networking
ZDI-26-573 reopens a persistent architectural question in Linux kernel design. The insertion of complex network protocol parsers into kernel space — KSMBD has been operational since kernel 5.15 — shortens the path between received packet and kernel memory, but also compresses the attack surface into a context where every bug has maximum consequences.
The choice between KSMBD and Samba is not neutral from a security standpoint: the userspace model pays a context-switch overhead but gains memory isolation, process sandboxing, and patching granularity. The trend of enabling KSMBD in NAS and embedded scenarios for throughput reasons makes this vulnerability relevant for a type of infrastructure often undersized in terms of monitoring and patch cycle.
The absence of CVE and CVSS in the ZDI advisory constitutes an operational limitation for security teams that depend on these identifiers for automated prioritization, but does not attenuate the intrinsic severity of the execution context.
Frequently Asked Questions
Is Samba vulnerable?
No. The advisory refers exclusively to KSMBD, a separate in-kernel implementation from Samba, which operates in userspace.
Are all Linux systems at risk?
No. Only systems with the KSMBD subsystem enabled are exposed according to the ZDI advisory.
Is authentication required to exploit the flaw?
No. Authentication is not required for exploitation, as documented in the advisory.
Sources
- http://www.zerodayinitiative.com/advisories/ZDI-26-573/
- https://www.trendmicro.com/
- https://www.trendmicro.com/en_us/business/products/one-platform.html
Information is based on the cited source and current as of publication.