The Linux kernel has two remote code execution flaws with public details and no patch available today. The worst part: one of them does not even require a password.
The case is ksmbd, the SMB server built into the kernel itself, the piece that makes a Linux server speak the Windows file protocol. ZDI, Trend Micro''s research program, rated both 9.0.
The two flaws
The first, ZDI-CAN-33774, is a race in protocol dispatch that runs unauthenticated: a burst of SMB1 packets followed by an SMB2 packet on the same connection makes the worker process one side''s data with the other''s handler, reading past the end of the buffer. The second, ZDI-CAN-33549, is an integer underflow in the SMB Direct path, and it needs three things: an RDMA interface, a writable share, and a client negotiating SMB Direct.
The fix status is what scares
Neither flaw has a named fix in the mainline kernel or the integration tree, and the kernel project only assigns a CVE identifier after the fix reaches the stable tree, which means today these flaws have no CVE, only public details. The SMB Direct path maintainer sent a fix for one of the cases targeting the next development cycle, according to technical coverage, and it still takes weeks for the fix to reach the distributions.
The story behind the disclosure
The reports came from TrendAI, Trend Micro''s own AI scanner, and were copied to the kernel''s public lists along with the private channel, with no patch attached.
The kernel''s security documentation, updated in May under Linus Torvalds'' guidance, says that a bug found by AI is, by definition, a public bug. The stable kernel maintainer replied that, with no patch and on a public list, there was not much to do, and asked that the submission process be fixed.
What to do, in two commands
For operators, the check is two commands: systemctl status ksmbd and lsmod | grep ksmbd confirm whether the module is active. Red Hat Enterprise Linux does not ship ksmbd by default, and a server that does not need kernel SMB resolves the risk by unloading the module and closing port 445. Whoever needs the service keeps the surface behind a firewall and follows the stable tree.
It is the same response design as the Windows kernel RCE via SMB/RDP: patch when it exists, and while it does not, minimal surface and segmentation. And it is the same week as PHP2Shell: the month produced two major cases born from the same void, the window between public detail and available fix.
At Tech86, kernel surface governance is a project: inventory what runs, what exposes a port, and what to turn off until the fix reaches the distribution.
Conclusion
The window between public details and an available fix is the only period the attacker needs. From PHP to the kernel, the month''s two biggest cases were born from the same void, and the new rule treating AI findings as public opened that void in writing. The surface inventory is what closes the gap while the patch does not arrive.