Linux kernel ksmbd EUVD-2026-27748

Requires Linux kernel ksmbd module actively loaded and listening for SMB connections with SMB Direct (RDMA over Converged Ethernet or InfiniBand) support compiled and enabled. The vulnerable code path is only reachable when a client initiates SMB Direct protocol negotiation specifically, not through standard SMB2/SMB3 connections. Most Linux distributions ship ksmbd as an optional module not loaded by default, significantly limiting attack surface. Systems explicitly configured for high-performance SMB file sharing using RDMA transport are at risk. No authentication, user interaction, or non-default SMB configuration is required beyond having SMB Direct enabled. Standard SMB connections over TCP port 445 without RDMA do not trigger this vulnerability. The specific function smb_direct_prepare_negotiation() must be reached, which occurs during the initial protocol handshake before any authentication exchange.

Despite the critical CVSS 9.8 score indicating maximum severity across confidentiality, integrity, and availability with network vector (AV:N) and no authentication required (PR:N), the low EPSS score of 0.02% (4th percentile) suggests minimal observed exploitation in the wild. The attack requires the target system to have ksmbd module loaded with SMB Direct/RDMA support enabled, which is not a default configuration on most Linux distributions. The vulnerability is automatable once prerequisites are met (AC:L), enabling wormable exploitation scenarios. Real-world risk stratifies based on deployment: extremely high for Linux-based NAS devices and file servers with SMB Direct enabled, moderate for general Linux servers (where ksmbd adoption remains limited compared to userspace Samba), and negligible for systems without ksmbd loaded. The availability of vendor patches across all maintained kernel branches significantly reduces ongoing risk for patched systems. Priority should be highest for internet-facing SMB services and environments where SMB Direct performance features are enabled. The pre-authentication nature makes this particularly dangerous as it requires no valid credentials to trigger.

An external attacker scans for Linux servers with ksmbd SMB Direct services exposed on port 5445/TCP. Without requiring authentication, the attacker initiates an SMB Direct negotiation and sends a specially crafted negotiation request with preferred_send_size set to 0x80000000. The signedness bug causes the kernel to accept this value as the maximum receive size. The attacker immediately follows with a second SMB Direct message containing 2000 bytes of payload data, significantly exceeding the corrupted size limit. This triggers a heap buffer overflow in kernel space, overwriting adjacent memory structures. By carefully crafting the overflow payload with ROP chains or kernel exploit primitives, the attacker achieves arbitrary code execution in kernel context, gaining complete control over the system. Public exploit code availability is unknown based on provided data, but the detailed vulnerability description provides sufficient information for skilled attackers to develop reliable exploits.