ALERT — Linux Kernel 0-Click RCE in ksmbd (SMB in-kernel) Published by CyberDudeBivash — ThreatWire / Daily Intel (rapid advisory)

 

TL;DR: A critical remote code execution (RCE) class of vulnerabilities affecting the Linux kernel’s ksmbd (in-kernel SMB3 server) implementation has been documented and expanded into proof-of-concept / exploit writeups by researchers. Some of these flaws are use-after-free / refcount / slab/out-of-bounds issues that can be triggered remotely without user interaction (0-click), potentially allowing unauthenticated attackers to achieve kernel-level code execution on systems with ksmbd enabled. Apply vendor/kernel updates immediately, or disable ksmbd if you don’t need SMB in kernel space. NVD+2NVD+2

---

What happened (short)

Researchers have published technical writeups and proof-of-concept material showing how multiple ksmbd bugs can be chained or exploited to achieve remote kernel code execution without any user interaction — i.e., a 0-click RCE against Linux systems that expose in-kernel SMB services. These include recent CVEs (e.g., CVE-2025-37899 and related ksmbd fixes) and newly discussed exploit chains. Public coverage and PoC reporting accelerated after the technical posts and NVD/kernel advisories were updated. NVD+2Daily CyberSecurity+2

---

Why this is critical

• ksmbd runs in kernel space — a successful exploit provides kernel-level privileges, enabling total system compromise. NVD

• Some of the documented issues are triggerable remotely and without user interaction (0-click), increasing the urgency for patching and network controls. Daily CyberSecurity

• ksmbd may be present/enabled on servers, NAS devices, and some Linux distributions (or enabled by OEMs) — therefore blast radius includes Linux servers, appliances, and virtual machines that expose SMB over the network. Quorum Cyber

---

Affected components / CVEs (representative)

• CVE-2025-37899 — ksmbd: use-after-free in session logoff (kernel fixes published). NVD

• CVE-2025-39720 — ksmbd: refcount leak / resource not released (kernel fix noted). NVD

• Additional ksmbd-related advisories and out-of-bounds/race condition issues have been reported historically and re-examined in light of new PoCs. Review NVD/kernel.org entries for the full list. CVE+1

Note: ksmbd is not enabled by default on every distro, but many vendors or appliance makers do enable it for performance. Always confirm your environment.

---

Exploitation scenarios (high level — no exploit code)

• Remote attacker sends specially crafted SMB3 requests to a system with ksmbd listening (SMB port 445). Because ksmbd operates in kernel context and parses complex protocol inputs, malformed requests can trigger memory corruption (UAF, refcount issues, slab OOB) that an attacker can chain into arbitrary kernel code execution. NVD+1

• 0-click nature: an attacker does not require a user to click a link or open a file — simply being reachable over the network is sufficient in vulnerable configurations. Daily CyberSecurity

---

Immediate mitigation (action items — do these now)

1. Patch immediately

   • Upgrade to the latest kernel that contains the ksmbd fixes from kernel.org / your vendor. Check your distro vendor/security advisory for backported patches (Red Hat, SUSE, Canonical, Alpine, etc.). Confirm kernel package version and apply reboot where required. NVD+1

2. If you cannot patch right away — reduce exposure

   • Block inbound SMB (TCP 445, UDP 445) at the network edge (firewall, security groups) so ksmbd is not reachable from untrusted networks.

   • If ksmbd is unnecessary, disable/unload it: remove/blacklist the module or disable the service (modprobe -r ksmbd if possible and safe — verify module is not built into the running kernel). For systems where ksmbd is built-in, network blocking is critical. (Be cautious on production systems — unloading kernel modules can have side effects.) wiz.io

3. Harden SMB

   • Restrict SMB to internal, trusted subnets only. Enforce least privilege access.

   • Monitor for new/unknown SMB shares and mounts.

4. Inventory & scan

   • Identify machines with ksmbd enabled: check running modules and kernel configs, lsmod | grep ksmbd, grep -i ksmbd /boot/config-*, and vendor documentation. Scan your fleet for tcp:445 listening endpoints and correlate with distro/kernel versions. Quorum Cyber

---

Detection / Hunting recommendations

• Look for unexpected network traffic to/from port 445 from unfamiliar IPs.

• Detect abnormal ksmbd process/module activity or kernel messages in dmesg indicating OOPS, stack traces, or KASAN/KMSAN reports.

• Add alerts for sudden increases in anonymous session attempts or malformed SMB session negotiations.

• Review logs for kernel panics, oopses, and unexpected reboots that could indicate attempted exploitation.

• If you have EDR/XDR with kernel telemetry, watch for anomalous kernel memory writes or new init_task changes. (Tailor to capabilities — many EDRs don’t instrument kernel internals.) NVD

---

For SOCs / Incident Responders

• Isolate suspect hosts from network immediately. Capture memory and relevant kernel logs for forensic analysis (preserve evidence).

• If you detect successful compromise/vector activity, assume full kernel compromise — rebuild from known-good images and rotate keys/credentials.

• Notify upstream vendors and follow disclosure guidance if you operate affected appliances.

---

How CyberDudeBivash recommends you respond

1. Patch or block now.

2. Inventory for ksmbd exposure across cloud, on-prem, and appliances.

3. Hunt for indicators (SMB anomalies, kernel logs, abnormal processes).

4. If compromised, rebuild and rotate credentials — do not try a live patch recovery for suspected kernel-level root compromise.

---

Sources & further reading

• NVD / kernel advisories for CVE-2025-37899 (ksmbd use-after-free). NVD

• NVD entry and analysis for CVE-2025-39720 (ksmbd refcount leak). NVD

• Rapid reporting and PoC discussion (securityonline.info / BitsByWill analysis). Daily CyberSecurity

• Vendor/security writeups summarizing impact and mitigations. Quorum Cyber+1

---

Closing — CyberDudeBivash word

This ksmbd class of vulnerabilities is a kernel-level risk with a fast, high-impact attack surface when exposed. Treat any system running an unpatched ksmbd implementation as high critical. If you want, I’ll produce a ready-to-publish CyberDudeBivash advisory (long-form, SEO optimized) for your blog and social channels — including step-by-step patch guidance per major distro, turnkey detection queries for common SIEMs, and a downloadable incident playbook.

Stay safe. Stay patched. — CyberDudeBivash

#CyberDudeBivash #ksmbd #LinuxKernel #ZeroClick #RCE #SMB #PatchNow #ThreatIntel #CVE #Infosec