ZDI-26-1004: Linux KSMBD Uninitialized Resource Info Disclosure — Detection and Remediation Guide

---
title: Suspicious SMB Traffic to KSMBD Service
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects high-volume or anomalous SMB requests to Linux systems running KSMBD, which may indicate exploitation attempts targeting ZDI-26-1004.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-1004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1046
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 445
    Initiated: 'true'
  filter_known_smb_servers:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_known_smb_servers
falsepositives:
  - Legitimate SMB file sharing traffic from external partners
  - Network scanning or inventory tools
level: medium
---
title: KSMBD Module Loaded on Linux System
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects loading of the KSMBD kernel module, which may indicate enabling of vulnerable SMB services. Useful for inventory and hunting purposes.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-1004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1046
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'modprobe ksmbd'
      - 'insmod ksmbd'
      - 'ksmbd'
falsepositives:
  - Legitimate system administration enabling SMB services
  - Automated configuration management tools (Ansible, Puppet, Chef)
level: low
---
title: Anomalous SMB Response Size from Linux Host
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects unusually large SMB responses from Linux systems, which may indicate information disclosure exploitation attempts.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-1004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    SourcePort: 445
    BytesSent|gt: 1048576
  condition: selection
falsepositives:
  - Large file transfers over SMB
  - Backup or replication traffic
level: medium

// Hunt 1: Identify Linux systems with KSMBD module loaded
// Requires Syslog ingestion with kernel module load events
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage contains "ksmbd"
| where SyslogMessage contains "module" or SyslogMessage contains "loaded"
| summarize Count = count() by Computer, SyslogMessage, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;

// Hunt 2: High-volume SMB traffic to Linux systems (potential exploitation attempts)
// Requires CommonSecurityLog (CEF) or network flow logs
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 445
| where DeviceOSType contains "Linux"
| summarize ConnectionCount = count(), UniqueSources = dcount(SourceIP), TotalBytesSent = sum(SentBytes) by DestinationIP, DestinationHostName, bin(TimeGenerated, 15m)
| where ConnectionCount > 100 or UniqueSources > 10
| order by ConnectionCount desc;

// Hunt 3: Unauthenticated SMB session attempts
// Requires Syslog ingestion with KSMBD or SMB service logs
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage contains "ksmbd" or SyslogMessage contains "SMB"
| where SyslogMessage contains "unauthenticated" or SyslogMessage contains "anonymous" or SyslogMessage contains "failed"
| summarize AttemptCount = count() by Computer, SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage), bin(TimeGenerated, 1h)
| where AttemptCount > 50
| order by AttemptCount desc;

-- Hunt for KSMBD module loaded and active SMB connections
-- Target: Linux systems with Velociraptor agent

-- Check if KSMBD module is loaded
LET ksmbd_module = SELECT * FROM execve(argv=['lsmod'])
WHERE STDOUT =~ 'ksmbd';

-- Enumerate active network connections on port 445
LET smb_connections = SELECT * FROM netstat()
WHERE Laddr.Port = 445 AND State = 'LISTEN';

-- Combine results
SELECT 
  'KSMBD Module Loaded' AS Check,
  CASE 
    WHEN ksmbd_module THEN 'YES - VULNERABLE'
    ELSE 'NO'
  END AS Status,
  smb_connections.Laddr.IP AS ListeningIP,
  smb_connections.Laddr.Port AS Port
FROM scope()
WHERE ksmbd_module OR smb_connections;

#!/bin/bash
# ZDI-26-1004 KSMBD Vulnerability Remediation Script
# Purpose: Audit, disable, and harden systems against KSMBD info disclosure

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

echo "=========================================="
echo "ZDI-26-1004 KSMBD Vulnerability Audit"
echo "=========================================="
echo ""

# Check 1: Is KSMBD module loaded?
echo "[1] Checking if KSMBD module is loaded..."
if lsmod | grep -q ksmbd; then
    echo -e "${RED}[VULNERABLE] KSMBD module is currently loaded${NC}"
    KSMBD_LOADED=true
    lsmod | grep ksmbd
else
    echo -e "${GREEN}[OK] KSMBD module is not loaded${NC}"
    KSMBD_LOADED=false
fi
echo ""

# Check 2: Is KSMBD module available (even if not loaded)?
echo "[2] Checking if KSMBD module is available on this system..."
if modinfo ksmbd &>/dev/null; then
    echo -e "${YELLOW}[INFO] KSMBD module is available (can be loaded)${NC}"
    KSMBD_AVAILABLE=true
    modinfo ksmbd | head -5
else
    echo -e "${GREEN}[OK] KSMBD module is not available on this system${NC}"
    KSMBD_AVAILABLE=false
fi
echo ""

# Check 3: Is port 445 listening?
echo "[3] Checking if SMB port 445 is listening..."
if ss -tuln | grep -q ':445 '; then
    echo -e "${YELLOW}[WARNING] Port 445 is listening${NC}"
    ss -tuln | grep ':445 '
    PORT_445_OPEN=true
else
    echo -e "${GREEN}[OK] Port 445 is not listening${NC}"
    PORT_445_OPEN=false
fi
echo ""

# Remediation Actions
echo "=========================================="
echo "REMEDIATION ACTIONS"
echo "=========================================="

if [ "$KSMBD_LOADED" = true ]; then
    echo -e "${YELLOW}[ACTION] KSMBD is loaded. Choose remediation action:${NC}"
    echo "  1) Unload KSMBD module (temporary - will reload on reboot)"
    echo "  2) Blacklist KSMBD module (persistent - prevents loading)"
    echo "  3) Skip (you will patch manually)"
    read -p "Enter choice [1-3]: " choice
    
    case $choice in
        1)
            echo "Unloading KSMBD module..."
            modprobe -r ksmbd
            echo -e "${GREEN}[DONE] KSMBD unloaded${NC}"
            ;;
        2)
            echo "Blacklisting KSMBD module..."
            echo "blacklist ksmbd" > /etc/modprobe.d/blacklist-ksmbd.conf
            echo "install ksmbd /bin/true" >> /etc/modprobe.d/blacklist-ksmbd.conf
            modprobe -r ksmbd
            echo -e "${GREEN}[DONE] KSMBD blacklisted and unloaded${NC}"
            ;;
        3)
            echo -e "${YELLOW}[SKIPPED] Manual remediation required${NC}"
            ;;
        *)
            echo -e "${RED}[ERROR] Invalid choice${NC}"
            ;;
    esac
fi

if [ "$KSMBD_AVAILABLE" = true ] && [ "$KSMBD_LOADED" = false ]; then
    echo -e "${YELLOW}[INFO] KSMBD is available but not loaded.${NC}"
    read -p "Blacklist KSMBD to prevent future loading? [y/N]: " blacklist_choice
    if [[ $blacklist_choice =~ ^[Yy]$ ]]; then
        echo "Blacklisting KSMBD module..."
        echo "blacklist ksmbd" > /etc/modprobe.d/blacklist-ksmbd.conf
        echo "install ksmbd /bin/true" >> /etc/modprobe.d/blacklist-ksmbd.conf
        echo -e "${GREEN}[DONE] KSMBD blacklisted${NC}"
    fi
fi

echo ""
echo "=========================================="
echo "PATCHING GUIDANCE"
echo "=========================================="
echo ""
echo "To fully remediate this vulnerability, apply kernel patches:"
echo ""
echo "Ubuntu/Debian:"
echo "  sudo apt update && sudo apt upgrade linux-image-generic"
echo ""
echo "RHEL/CentOS:"
echo "  sudo yum update kernel"
echo ""
echo "SUSE:"
echo "  sudo zypper update kernel-default"
echo ""
echo "After patching, reboot the system:"
echo "  sudo reboot"
eecho ""
echo "Verify patch installation:"
echo "  uname -r"
echo "  # Compare against patched kernel versions from your vendor"
echo ""

echo "=========================================="
echo "Audit complete. Review findings above."
echo "=========================================="

4. **Network Segmentation:**
   - Restrict SMB (TCP 445) access to trusted networks only.
   - Use firewall rules to limit exposure:
     ```
sudo iptables -A INPUT -p tcp --dport 445 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP