KSMBD Zero-Day RCE Flaws (ZDI-CAN-33774 & ZDI-CAN-33549): Defending Linux SMB Servers Before the Patch Lands

# Check whether the ksmbd kernel module is loaded
lsmod | grep -i ksmbd

# Check whether the module exists on the system at all (could be loaded on demand)
find /lib/modules/$(uname -r) -name 'ksmbd*' 2>/dev/null
modinfo ksmbd 2>/dev/null | head -20

# Check for the ksmbd userspace daemon and configuration
ps aux | grep -i [k]smbd
systemctl status ksmbd 2>/dev/null
ls -l /etc/ksmbd/ 2>/dev/null

# Confirm which process is actually listening on 445 — ksmbd shows as kernel threads,
# samba shows as smbd
ss -tlnp | grep -E ':445|:139'

# Check for RDMA-capable interfaces (relevant to ZDI-CAN-33549)
ibv_devices 2>/dev/null || rdma link 2>/dev/null

# Check whether SMB Direct is enabled in the ksmbd configuration
grep -ri 'smb direct\|rdma' /etc/ksmbd/ 2>/dev/null

---
title: KSMBD Kernel Module Loaded or Daemon Started
id: 4f2a1b8c-9d3e-4c7a-b6f5-8a1d2e3c4b5a
status: experimental
description: Detects loading of the KSMBD kernel module or execution of ksmbd userspace utilities, which expands the attack surface for ZDI-CAN-33774 and ZDI-CAN-33549. Alert on any host where KSMBD is not an approved, documented service.
references:
  - https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html
  - https://www.zerodayinitiative.com/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: linux
detection:
  selection_modprobe:
    Image|endswith:
      - '/modprobe'
      - '/insmod'
    CommandLine|contains: 'ksmbd'
  selection_tools:
    Image|endswith:
      - '/ksmbd.mountd'
      - '/ksmbd.adduser'
      - '/ksmbd.addshare'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration of approved KSMBD file servers
level: high
---
title: Linux File Server Spawning Unexpected Shell or Downloader
id: 7c3d9e21-5a8b-4f6c-9d2e-1b4a7c8d3f60
status: experimental
description: Detects shells, downloaders, and scripting interpreters spawned on hosts where the only expected network-facing service is SMB. Successful KSMBD kernel exploitation is typically followed by post-exploitation tooling. Tune the parent filter to your environment; on dedicated file servers almost no interactive shells should exist.
references:
  - https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059.004
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_children:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/socat'
  filter_legit_parents:
    ParentImage|endswith:
      - '/sshd'
      - '/systemd'
      - '/cron'
      - '/crond'
      - '/ansible-playbook'
      - '/sudo'
  condition: selection_children and not filter_legit_parents
falsepositives:
  - Configuration management agents
  - Monitoring agents executing scripts
level: high
---
title: Kernel Taint or Oops Event on SMB File Server
id: 2e8f4a17-6b9c-4d5e-8f3a-9c1b7d2e5a48
status: experimental
description: Detects execution of crash/log inspection following kernel faults, and flags kernel oops or BUG messages in syslog on SMB-serving hosts. Failed exploit attempts against KSMBD frequently cause kernel worker crashes or oopses before a successful payload is achieved.
references:
  - https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.defense_evasion
logsource:
  product: linux
  service: syslog
detection:
  selection:
    - 'kernel: BUG:'
    - 'kernel: general protection fault'
    - 'kernel: Oops'
    - 'ksmbd: '
    - 'kernel: RIP:'
  condition: selection
falsepositives:
  - Hardware faults and driver bugs; correlate with SMB exposure before dismissing
level: medium

// Hunt for KSMBD exposure and anomalous SMB session behavior across Linux estate
// Requires Syslog/CEF ingestion into Sentinel from Linux hosts and firewalls

// Part 1: Identify hosts with ksmbd module events or kernel faults mentioning ksmbd
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("ksmbd", "smb_direct", "smbdirect")
    or (SyslogMessage has_any ("BUG", "Oops", "general protection fault") and Computer in (
        toscalar(Syslog | where SyslogMessage has "ksmbd" | distinct Computer)))
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SampleMessages=make_list(strcat(SyslogMessage), 5)
    by Computer, Facility, SeverityLevel
| sort by LastSeen desc;

// Part 2: Detect connection spikes to TCP/445 on Linux file servers from single sources
// Pre-auth exploit attempts typically involve many short-lived connections or unusual source geographies
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 445
| summarize ConnectionCount=count(), DistinctSources=dcount(SourceIP), SourceIPs=make_set(SourceIP, 25)
    by DestinationHostName, DestinationIP, bin(TimeGenerated, 1h)
| where ConnectionCount > 200 or DistinctSources > 50
| sort by ConnectionCount desc;

// Part 3: Post-exploitation signal — outbound connections from file servers to rare destinations
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort == 445 or InitiatingProcessFileName has_any ("ksmbd", "smbd")
| extend Direction = "inbound"
| union (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where DeviceName in (toscalar(DeviceNetworkEvents | where LocalPort == 445 | distinct DeviceName))
    | where RemotePort !in (445, 139, 53, 123, 443, 80) and RemoteIPType == "Public"
    | extend Direction = "outbound_from_file_server"
)
| summarize by DeviceName, Direction, RemoteIP, RemotePort, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| sort by TimeGenerated desc;

-- Velociraptor artifact: Audit hosts for KSMBD exposure and suspicious listeners
-- Deploy across Linux fleet to scope ZDI-CAN-33774 / ZDI-CAN-33549 exposure

-- Find processes and kernel threads related to ksmbd
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'ksmbd|smbd'
   OR CommandLine =~ 'ksmbd'

-- Enumerate listeners on SMB ports and identify owning processes
SELECT Pid, Name, Address, Port, Status, CommandLine
FROM netstat()
WHERE Port in (139, 445)
  AND Status =~ 'LISTEN'

-- Check for ksmbd configuration artifacts on disk
SELECT FullPath, Size, Mtime
FROM glob(globs=['/etc/ksmbd/**', '/etc/ksmbd/smb.conf', '/usr/sbin/ksmbd*'])

-- Identify RDMA-capable interfaces (relevant to ZDI-CAN-33549 attack surface)
SELECT FullPath, Mtime
FROM glob(globs=['/sys/class/infiniband/*/ports/*/state'])

#!/usr/bin/env bash
# KSMBD Zero-Day Mitigation Script — ZDI-CAN-33774 / ZDI-CAN-33549
# Run as root. Idempotent. Logs actions to /var/log/ksmbd_mitigation.log

LOG=/var/log/ksmbd_mitigation.log
echo "=== KSMBD mitigation run $(date -u) ===" >> "$LOG"

# 1. Detect whether ksmbd is in use
if lsmod | grep -q ksmbd; then
    echo "[!] ksmbd kernel module is LOADED on this host" | tee -a "$LOG"
    KSMBD_ACTIVE=1
else
    echo "[+] ksmbd module not loaded" | tee -a "$LOG"
    KSMBD_ACTIVE=0
fi

# 2. Stop and disable the ksmbd service if present
if systemctl list-unit-files 2>/dev/null | grep -q '^ksmbd'; then
    systemctl stop ksmbd 2>/dev/null && echo "[+] ksmbd service stopped" >> "$LOG"
    systemctl disable ksmbd 2>/dev/null && echo "[+] ksmbd service disabled" >> "$LOG"
    systemctl mask ksmbd 2>/dev/null && echo "[+] ksmbd service masked (cannot be re-enabled accidentally)" >> "$LOG"
fi

# 3. Unload the kernel module if no active sessions depend on it
if [ "$KSMBD_ACTIVE" -eq 1 ]; then
    if modprobe -r ksmbd 2>/dev/null; then
        echo "[+] ksmbd module unloaded" >> "$LOG"
    else
        echo "[!] Could not unload ksmbd — active sessions or dependencies. Reboot required." | tee -a "$LOG"
    fi
fi

# 4. Blacklist the module so it cannot load on boot or on demand
cat > /etc/modprobe.d/blacklist-ksmbd.conf <<'EOF'
# Block KSMBD pending patch for ZDI-CAN-33774 / ZDI-CAN-33549 (CVSS 9.0, pre-auth RCE)
blacklist ksmbd
install ksmbd /bin/false
EOF
echo "[+] ksmbd blacklisted via /etc/modprobe.d/blacklist-ksmbd.conf" >> "$LOG"

# 5. Disable SMB Direct / RDMA path if it was configured (ZDI-CAN-33549)
if [ -f /etc/ksmbd/smb.conf ]; then
    cp /etc/ksmbd/smb.conf "/etc/ksmbd/smb.conf.bak.$(date +%s)"
    sed -i 's/^\s*smb direct\s*=.*/\tsmb direct = no/I' /etc/ksmbd/smb.conf
    echo "[+] SMB Direct disabled in /etc/ksmbd/smb.conf (backup created)" >> "$LOG"
fi

# 6. Restrict port 445 exposure at the host firewall (defense in depth)
#    Adjust the allowed source range to your legitimate SMB client subnet
ALLOWED_SMB_SUBNET="10.0.0.0/8"
if command -v iptables >/dev/null 2>&1; then
    iptables -C INPUT -p tcp --dport 445 -s "$ALLOWED_SMB_SUBNET" -j ACCEPT 2>/dev/null || \
        iptables -I INPUT -p tcp --dport 445 -s "$ALLOWED_SMB_SUBNET" -j ACCEPT
    iptables -C INPUT -p tcp --dport 445 -j DROP 2>/dev/null || \
        iptables -A INPUT -p tcp --dport 445 -j DROP
    echo "[+] iptables: 445 restricted to $ALLOWED_SMB_SUBNET" >> "$LOG"
fi

# 7. Verify Samba (userspace smbd) is the replacement, NOT affected by these flaws
if pgrep -x smbd >/dev/null; then
    echo "[+] Samba smbd running — unaffected by KSMBD flaws" >> "$LOG"
else
    echo "[!] No smbd running. If file sharing is required, migrate shares to Samba." | tee -a "$LOG"
fi

echo "=== Mitigation complete. Review $LOG ==="