[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f2kc7ka5ce9kgt":56,"i-tabler:arrow-left":120,"i-tabler:tag":122},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":69,"html":70,"metaTitle":58,"metaDescription":71,"shareImage":72,"updatedAt":61,"author":76,"related":78},"ksmbd-zdi-unpatched-reports-public-lists","Unpatched KSMBD Bugs Hit Public Kernel Lists: What It Means for You","Trend Micro ZDI copied unpatched Linux kernel bug reports, including two CVSS 9.0 KSMBD flaws, to public mailing lists. Greg Kroah-Hartman objected. The exposure is narrow: only hosts running the in-kernel SMB server. Here is how to check.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fksmbd_zdi_public_lists-2.png","2026-10-24T12:00:00.000+08:00",[63,66],{"key":64,"label":65},"advisories","Advisories",{"key":67,"label":68},"security","Security",4,"\u003Cp>On October 22 (Manila time), Trend Micro's Zero Day Initiative (ZDI) sent a batch of Linux kernel vulnerability reports to the kernel security team, as it should. The problem was the CC line. The same reports went to public mailing lists, including linux-kernel and linux-cifs, with full technical detail and reproducers, and with no patches attached.\u003C\u002Fp>\u003Cp>Two of them carry a CVSS score of 9.0 and target KSMBD, the SMB3 file server that lives inside the Linux kernel. That sounds alarming. For most Linux machines, it is not. Here is what was actually posted, what the maintainers said, and how to check your own systems in a minute.\u003C\u002Fp>\u003Ch2 id=\"what-was-posted\">What was posted\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Flkml\u002FBYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com\u002F?ref=ghost.jdneer.com\">\u003Cstrong>ZDI-CAN-33549\u003C\u002Fstrong>\u003C\u002Fa>\u003Cstrong>:\u003C\u002Fstrong> \"Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability,\" CVSS 9.0 (AV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:H). The bug is an integer underflow in \u003Ccode>smbdirect_connection_rdma_xmit()\u003C\u002Fcode>. The report lists three requirements: an RDMA device, a writable share, and SMB Direct. ZDI reproduced it on kernel 7.3-rc3 built with \u003Ccode>CONFIG_SMB_SERVER_SMBDIRECT=y\u003C\u002Fcode>, using the software RDMA driver (\u003Ccode>CONFIG_RDMA_RXE=y\u003C\u002Fcode>) and a guest share.\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Flkml\u002FBYAPR01MB383076AC412E19C48CFBEAE980662@BYAPR01MB3830.prod.exchangelabs.com\u002F?ref=ghost.jdneer.com\">\u003Cstrong>ZDI-CAN-33774\u003C\u002Fstrong>\u003C\u002Fa>\u003Cstrong>:\u003C\u002Fstrong> \"Linux Kernel KSMBD Protocol Dispatch Race Condition Remote Code Execution Vulnerability,\" also CVSS 9.0 with the same vector. Per the report, a 40-byte SMB1 buffer can be parsed as a 64-byte SMB2 header, leaking 28 bytes of heap in an error reply, and there is also a path to an out-of-bounds write. In ZDI's words: \"The trigger requires race and guest share.\" Also tested on 7.3-rc3.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Neither report has a CVE ID yet. Both appear on ZDI's \u003Ca href=\"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002Fupcoming\u002F?ref=ghost.jdneer.com\">upcoming advisories\u003C\u002Fa> list under these tracking IDs. The same batch included reports for other kernel areas (networking, the VMware graphics driver, the NVMe target), which are local issues and not the focus here.\u003C\u002Fp>\u003Ch2 id=\"greg-kroah-hartman-was-not-amused\">Greg Kroah-Hartman was not amused\u003C\u002Fh2>\u003Cp>Greg Kroah-Hartman, the stable kernel maintainer, answered several of the reports on the list within minutes. To the VMware graphics report he \u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Fdri-devel\u002F2026102254-protector-seventy-6454@gregkh\u002F?ref=ghost.jdneer.com\">wrote\u003C\u002Fa>: \"For some reason you sent this to public lists, and did not include a patch, so there's not much we can do with this.\" On the NVMe target report: \u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Fall\u002F2026102226-duly-imprison-a2c1@gregkh\u002F?ref=ghost.jdneer.com\">\"Again, no patch, and sent to a public list? Please fix your submission process...\"\u003C\u002Fa> And on ZDI-CAN-33774, the KSMBD race: \u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Fall\u002F2026102244-decade-icing-82ed@gregkh\u002F?ref=ghost.jdneer.com\">\"And again, no patch, and a public list?\"\u003C\u002Fa>\u003C\u002Fp>\u003Cp>His point is fair. Kernel security reports normally reach maintainers privately so a fix can land before the details go public. Publishing a detailed report without a patch gives attackers a head start and gives defenders nothing to install.\u003C\u002Fp>\u003Ch2 id=\"are-there-fixes\">Are there fixes?\u003C\u002Fh2>\u003Cp>Not in a released kernel yet, as far as I can see, but the maintainers were not starting from zero:\u003C\u002Fp>\u003Cul>\u003Cli>\u003Cstrong>ZDI-CAN-33774:\u003C\u002Fstrong> KSMBD maintainer Namjae Jeon \u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Flkml\u002FBYAPR01MB383076AC412E19C48CFBEAE980662@BYAPR01MB3830.prod.exchangelabs.com\u002F?ref=ghost.jdneer.com\">replied\u003C\u002Fa> that \"This issue has already been fixed,\" pointing to commit \u003Ca href=\"https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Flinkinjeon\u002Fsmb.git\u002Fcommit\u002F?id=68f410faedaf6ee74d81e574733c50ebcc1bd8ed&ref=ghost.jdneer.com\">68f410faedaf (\"ksmbd: wait for negotiation before receiving another PDU\")\u003C\u002Fa>, dated September 30, 2026, in his ksmbd tree for the next merge window.\u003C\u002Fli>\u003Cli>\u003Cstrong>ZDI-CAN-33549:\u003C\u002Fstrong> Stefan Metzmacher \u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Flkml\u002FBYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com\u002F?ref=ghost.jdneer.com\">asked\u003C\u002Fa> ZDI to retest on his \u003Ca href=\"https:\u002F\u002Fgit.samba.org\u002F?p=metze\u002Flinux\u002Fwip.git;a=shortlog;h=refs\u002Fheads\u002Ffor-7.5\u002Fsmbdirect&ref=ghost.jdneer.com\">for-7.5\u002Fsmbdirect branch\u003C\u002Fa>, writing: \"I guess it's already fixed with that.\" That is a likely fix, not a confirmed one.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Until these reach your distribution's kernel, treat both as unpatched on running systems.\u003C\u002Fp>\u003Ch2 id=\"why-the-exposure-is-narrow\">Why the exposure is narrow\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>KSMBD only.\u003C\u002Fstrong> This is not \"all Linux.\" Only hosts running the in-kernel SMB server are in scope.\u003C\u002Fli>\u003Cli>\u003Cstrong>Guest shares.\u003C\u002Fstrong> Both reproducers use a guest-accessible share.\u003C\u002Fli>\u003Cli>\u003Cstrong>RDMA for 33549.\u003C\u002Fstrong> The SMB Direct bug also needs SMB Direct support in the kernel and an RDMA device. No RDMA, no exposure to that one.\u003C\u002Fli>\u003Cli>\u003Cstrong>No reported exploitation.\u003C\u002Fstrong> I found no report of either bug being exploited in the wild, and no public exploit beyond the reproducers in ZDI's own reports.\u003C\u002Fli>\u003C\u002Ful>\u003Ch2 id=\"are-you-affected\">Are you affected?\u003C\u002Fh2>\u003Cp>Run these on each Linux server, NAS, or appliance where you have shell access:\u003C\u002Fp>\u003Cp>\u003Cstrong>Who is listening on 445?\u003C\u002Fstrong>\u003C\u002Fp>\u003Cpre>\u003Ccode>ss -ltnp | grep ':445'\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>\u003Cstrong>Do you have RDMA devices?\u003C\u002Fstrong> (relevant to ZDI-CAN-33549)\u003C\u002Fp>\u003Cpre>\u003Ccode>ls \u002Fsys\u002Fclass\u002Finfiniband 2>\u002Fdev\u002Fnull\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>\u003Cstrong>Is it built into your kernel, and with SMB Direct?\u003C\u002Fstrong>\u003C\u002Fp>\u003Cpre>\u003Ccode>grep -E 'CONFIG_SMB_SERVER(_SMBDIRECT)?=' \u002Fboot\u002Fconfig-$(uname -r)\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>\u003Cstrong>Is the KSMBD userspace daemon running?\u003C\u002Fstrong> KSMBD does not serve shares until \u003Ccode>ksmbd.mountd\u003C\u002Fcode> (from ksmbd-tools) starts it.\u003C\u002Fp>\u003Cpre>\u003Ccode>systemctl status ksmbd\npgrep -a ksmbd.mountd\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>\u003Cstrong>Is the KSMBD module loaded?\u003C\u002Fstrong>\u003C\u002Fp>\u003Cpre>\u003Ccode>lsmod | grep ksmbd\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>No output means it is not loaded.\u003C\u002Fp>\u003Ch2 id=\"what-to-do-if-you-run-ksmbd\">What to do if you run KSMBD\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>If you need it, drop guest access.\u003C\u002Fstrong> Remove \u003Ccode>guest ok = yes\u003C\u002Fcode> from shares and \u003Ccode>map to guest = bad user\u003C\u002Fcode> from \u003Ccode>[global]\u003C\u002Fcode> in \u003Ccode>\u002Fetc\u002Fksmbd\u002Fksmbd.conf\u003C\u002Fcode>, then restart the service.\u003C\u002Fli>\u003Cli>\u003Cstrong>Keep TCP 445 off the internet.\u003C\u002Fstrong> Block it at the edge and allow it only from the networks that need file sharing.\u003C\u002Fli>\u003Cli>\u003Cstrong>Watch your distribution's kernel updates\u003C\u002Fstrong> for the fixes above, and for CVE IDs once they are assigned.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>\u003Cstrong>Turn it off if you do not need it:\u003C\u002Fstrong>\u003C\u002Fp>\u003Cpre>\u003Ccode>sudo systemctl disable --now ksmbd\nsudo modprobe -r ksmbd\necho 'install ksmbd \u002Fbin\u002Ffalse' | sudo tee \u002Fetc\u002Fmodprobe.d\u002Fdisable-ksmbd.conf\u003C\u002Fcode>\u003C\u002Fpre>\u003Ch2 id=\"my-take\">My take\u003C\u002Fh2>\u003Cp>The disclosure was sloppy, and the kernel's maintainers said so publicly. But the headline score oversells the risk for most people. If you never set up the in-kernel SMB server, you can stop worrying. If you did, especially with guest shares, spend five minutes on the checks above today.\u003C\u002Fp>\u003Cp>\u003Cem>Sources: ZDI reports on lore.kernel.org (\u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Flkml\u002FBYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com\u002F?ref=ghost.jdneer.com\">\u003Cem>ZDI-CAN-33549\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Flkml\u002FBYAPR01MB383076AC412E19C48CFBEAE980662@BYAPR01MB3830.prod.exchangelabs.com\u002F?ref=ghost.jdneer.com\">\u003Cem>ZDI-CAN-33774\u003C\u002Fem>\u003C\u002Fa>\u003Cem>), Greg Kroah-Hartman's replies (\u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Fdri-devel\u002F2026102254-protector-seventy-6454@gregkh\u002F?ref=ghost.jdneer.com\">\u003Cem>1\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Fall\u002F2026102226-duly-imprison-a2c1@gregkh\u002F?ref=ghost.jdneer.com\">\u003Cem>2\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Flore.kernel.org\u002Fall\u002F2026102244-decade-icing-82ed@gregkh\u002F?ref=ghost.jdneer.com\">\u003Cem>3\u003C\u002Fem>\u003C\u002Fa>\u003Cem>), \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgit.kernel.org\u002Fpub\u002Fscm\u002Flinux\u002Fkernel\u002Fgit\u002Flinkinjeon\u002Fsmb.git\u002Fcommit\u002F?id=68f410faedaf6ee74d81e574733c50ebcc1bd8ed&ref=ghost.jdneer.com\">\u003Cem>ksmbd fix commit 68f410faedaf\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgit.samba.org\u002F?p=metze\u002Flinux\u002Fwip.git;a=shortlog;h=refs\u002Fheads\u002Ffor-7.5\u002Fsmbdirect&ref=ghost.jdneer.com\">\u003Cem>for-7.5\u002Fsmbdirect branch\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002Fupcoming\u002F?ref=ghost.jdneer.com\">\u003Cem>ZDI upcoming advisories\u003C\u002Fem>\u003C\u002Fa>\u003Cem>. First reported by \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.phoronix.com\u002Fnews\u002FLKML-New-Trend-Vulnerabilities?ref=ghost.jdneer.com\">\u003Cem>Phoronix\u003C\u002Fem>\u003C\u002Fa>\u003Cem>.\u003C\u002Fem>\u003C\u002Fp>","Trend Micro ZDI copied unpatched Linux kernel bug reports, including two CVSS 9.0 KSMBD flaws, to public mailing lists. Greg Kroah-Hartman objected. The...",{"src":60,"width":73,"height":74,"type":75},1600,900,"image\u002Fpng",{"name":77,"url":10,"owner":5},"JD Bungart",[79,89,100,111],{"slug":80,"title":81,"excerpt":82,"image":83,"publishedAt":84,"topics":85,"readMinutes":88},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[86,87],{"key":64,"label":65},{"key":67,"label":68},1,{"slug":90,"title":91,"excerpt":92,"image":93,"publishedAt":94,"topics":95,"readMinutes":88},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[96,99],{"key":97,"label":98},"guides","Guides",{"key":67,"label":68},{"slug":101,"title":102,"excerpt":103,"image":104,"publishedAt":105,"topics":106,"readMinutes":88},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[107,110],{"key":108,"label":109},"opinion","Opinion",{"key":67,"label":68},{"slug":112,"title":113,"excerpt":114,"image":115,"publishedAt":116,"topics":117,"readMinutes":88},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[118,119],{"key":108,"label":109},{"key":67,"label":68},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":121},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]