ZDI-26-573: Pre-Auth Linux Kernel KSMBD Vulnerability Scores…

A critical flaw in the in-kernel KSMBD SMB server allows unauthenticated out-of-bounds reads leading to information disclosure and potential RCE when chained with other bugs. Only systems with ksmbd enabled are affected.

On August 13, 2026, the Trend Micro Zero Day Initiative (ZDI) published advisory ZDI-26-573 detailing a vulnerability in the Linux kernel's KSMBD subsystem. The flaw lets a remote attacker read past the end of an allocated buffer in the init_smb2_rsp_hdr function, disclosing kernel memory without requiring credentials — provided the ksmbd service is running on the target. The CVSS score is 9.3, per ZDI's published advisories list. Combined with other vulnerabilities, the bug can lead to arbitrary code execution in kernel context.

Key Takeaways

ZDI-26-573 affects only Linux systems with KSMBD enabled, not all Linux distributions
No authentication required: the attacker interacts directly with the listening SMB2 service
The mechanism is an out-of-bounds read in init_smb2_rsp_hdr caused by missing validation of user-supplied data
Linux has released a kernel update to fix the flaw; the report was coordinated with disclosure on 2026-08-13 after initial reporting on 2026-07-03

The Mechanism: How the Flaw Works in `init_smb2_rsp_hdr`

The KSMBD subsystem, introduced in Linux kernel 5.15, implements an SMB server directly in kernel space as an alternative to userspace Samba. The promise is higher performance by eliminating context-switch overhead between kernel and userspace.

When building the SMB2 response header, init_smb2_rsp_hdr fails to properly validate user-supplied data. The ZDI advisory states that "the issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer." This out-of-bounds read exposes contents of memory adjacent to the legitimate buffer — the documented information disclosure.

The trigger condition is precise: only systems with ksmbd enabled are vulnerable. The advisory explicitly states authentication is not required for exploitation. An attacker sends crafted SMB2 packets to the listening service and receives kernel memory data that should remain inaccessible.

From Information Disclosure to RCE: The Escalation Chain

The declared impact goes beyond simple information leakage. Per the advisory text, "an attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel." The wording is technical and binding: ZDI-26-573 alone does not guarantee remote code execution, but it serves as a link in an exploit chain that, combined with other flaws, yields full system compromise.

Kernel context is the highest privilege level on the system. Code execution at this level bypasses every userspace isolation mechanism, containers included. For an attacker, the strategic goal is to use the memory disclosure to stage a more complex exploit — for example, by locating function addresses, control structures, or other primitives useful for a follow-on attack.

KSMBD: The Kernel-Space Trade-off

KSMBD was proposed for high-I/O scenarios: NAS appliances, storage arrays, cloud instances with heavy SMB workloads. Adoption has grown among providers pitching Linux instances as cost-effective alternatives to Windows Server for file sharing. This advisory reopens the question of whether the marginal performance gain justifies the added kernel attack surface, especially when the service is exposed directly to the internet or unsegmented networks.

The ZDI advisory does not specify which kernel versions are affected, nor does it provide a CVE. No CVE is assigned in the primary advisory. The GitHub commit referenced as the patch (role linked_primary) returns a 404 error, so the fix details cannot be verified directly from the cited source.

"This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable." — Advisory ZDI-26-573

Immediate Actions

Priority steps follow directly from the documented facts:

Verify whether ksmbd is active on managed Linux systems: the vulnerability does not affect distributions where the module is not loaded or the service is not enabled
Apply the kernel update Linux has released to address the flaw, confirmed in the advisory
Restrict SMB exposure to the internet where possible: the lack of authentication makes every reachable instance an immediate target
Audit cloud instances where KSMBD may be enabled by default or as a performance option for file storage services

The advisory does not indicate whether public exploits exist or active exploitation is underway. These elements remain unverified at time of publication.

Editorial Line

ZDI-26-573 is a classic kernel vulnerability with a precise trigger condition but extreme impact. The combination of remote access, no authentication, and CVSS 9.3 demands a rapid but scoped response: only administrators who deliberately enabled KSMBD need to act. For everyone else, the priority is verification, not panic. The coordinated disclosure on 2026-08-13, one month after the 2026-07-03 report, allowed time for patch preparation. The unknown remains the exploit chain: the flaw alone leaks memory, but an actor capable of combining this primitive with other vulnerabilities can achieve far more.

Information verified against cited sources and current as of publication.

Sources

Sources and references

The Mechanism: How the Flaw Works in init_smb2_rsp_hdr