ZDI flags CVSS 9.0 race-condition RCE in Linux KSMBD
A protocol-handler mismatch between request enqueue and dequeue can leak kernel heap memory and open an out-of-bounds write path.
Trend Micro's Zero Day Initiative has disclosed a critical race condition in the Linux kernel's in-kernel SMB server, KSMBD, that can lead to remote code execution. The flaw is tracked as ZDI-CAN-33774 and carries a CVSS score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
KSMBD chooses the per-connection protocol operations when it enqueues each PDU, but the worker reads those operations only when it later dequeues the work. A second request can flip the connection from SMB1 to SMB2 handling while an earlier SMB1 buffer is still pending. The SMB2 response path then treats the short SMB1 allocation as a larger SMB2 header, reading past the end of the buffer and returning leaked heap bytes to the attacker in an error reply. ZDI also identifies a related path to an out-of-bounds write through SMB2 set-info security descriptor parsing.
Triggering the bug requires winning the race and access to a guest-reachable share. The issue was shown against kernel 7.3-rc3.