Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes
- ID
- 38396
- Status
- summarized
- Published
- 23 Oct 2026, 1:01 AM
- Fetched
- 23 Oct 2026, 2:25 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 23 Oct 2026, 2:26 AM
- Tags
- Audience
- developers
What happened
Two Linux KSMBD remote code execution flaws, both rated CVSS 9.0, were disclosed on public mailing lists before kernel fixes were available, according to The Hacker News on 22 Oct 2026. The excerpt gives no affected kernel versions, exploit details, or mitigations, so the practical scope is unclear beyond the disclosure timing.
Why it matters
If you run Linux servers with the in-kernel KSMBD SMB server exposed, this is a signal to check your distro's kernel advisory status and whether KSMBD is enabled. For most app developers and SaaS founders, the text does not provide enough detail to justify action beyond confirming KSMBD is not exposed.
Discussion angle
What should operators do when a CVSS 9.0 kernel flaw is public before fixes land, given this report omits affected versions and exploit status?