Two CVSS 9.0 Vulnerabilities Found in Linux Kernel's ksmbd — No Patch Yet

⚡ The 5-Second Summary - Two vulnerabilities in the Linux kernel's ksmbd module with a CVSS score of 9.0 have been disclosed — details were published before a patch was released. - Both affect the SMB server that listens on port 445. - There is no stable fix in any kernel version yet: the patch is still being prepared. ### 🔍 What Was Found Information about two vulnerabilities in ksmbd — the SMB server implementation built directly into the Linux kernel — has been made public. Both received a CVSS score of 9.0, which formally places them in the critical severity category. The key detail: the information was published before a patch became available — according to the source, at the time of publication there was no stable fix in any kernel branch. The attack mechanics are tied to the SMB network stack: ksmbd starts a server and listens on port 445, through which the impact occurs. In other words, exploiting the flaw does not require local access to the machine — it is enough to reach the open SMB port over the network. The exact conditions for triggering the flaw and the type of consequences (daemon crash / authentication bypass / other) are not disclosed in the original report — the researchers do not clarify the details until a patch is released. Until a fix is available, the only way to reduce the attack surface is to avoid keeping ksmbd enabled unnecessarily: unload the kernel module and block port 445 at the perimeter. You can check whether the server is running with ss -ltnp | grep 445 or lsmod | grep ksmbd. ### 💡 Why It Matters ksmbd is not a third-party daemon like Samba — it is part of the kernel itself, so it cannot be updated separately from the kernel: the patch will only arrive with a new kernel version. This turns the situation into a classic pre-patch gap, where you have to rely on temporary measures such as blocking port 445 while waiting for the patch to come with the next kernel release. For infrastructures with SMB access open from untrusted networks, this is a reason to double-check firewall rules right now.