ENGINEERING

← All posts · October 22, 2026 · By Brian Vitko

KSMBD: finding the Linux kernel’s SMB server before the fix ships, and why the usual module block doesn’t stop it

On October 22, Trend Micro’s Zero Day Initiative published two remote code execution bugs in KSMBD, the SMB file server built into the Linux kernel. Both are rated 9.0, and neither has a fix in the kernel yet:

There are no CVE numbers yet. The kernel assigns those once a fix lands in a stable kernel, and stable fixes usually take weeks to reach distribution kernels after that. So for now the only protection is not running it.

KSMBD is not Samba

Most Linux file servers run Samba, which is a normal program (smbd) and isn’t affected. KSMBD is a separate server that lives in the kernel itself. It’s newer and much less common.

On Ubuntu 26.04 the module ships with every kernel, with SMB Direct built in. It does nothing until someone installs ksmbd-tools and writes a share into /etc/ksmbd/ksmbd.conf. Installing the package enables ksmbd.service, and from then on it starts at every boot. Red Hat says RHEL doesn’t include KSMBD, and a Rocky 9.8 kernel has no ksmbd module to load.

Check one Linux machine

The quickest test is who owns port 445:

sudo ss -Hltnp 'sport = :445'

A line ending in users:(("smbd",...)) is Samba. A line with no users: part is the kernel, and that’s KSMBD serving. No output means nothing is listening on 445.

Two more commands fill in the rest:

lsmod | grep ksmbd
systemctl is-enabled ksmbd

The module being loaded doesn’t open a port on its own. In the lab I loaded it by hand with nothing configured, and port 445 stayed closed. The server only listens once ksmbd.mountd (from ksmbd-tools) gives it a configuration.

For the SMB Direct bug, check for RDMA devices:

ls /sys/class/infiniband

No output (or “No such file or directory”) means no RDMA device, and ZDI-CAN-33549 can’t be reached. The no-login bug still can. The directory itself exists whenever ksmbd is loaded, because ksmbd pulls in the RDMA core module, so only a name listed inside it counts.

Turn it off

If nobody uses those shares, stop the server and keep it from coming back:

sudo systemctl disable --now ksmbd
sudo systemctl mask ksmbd
sudo modprobe -r ksmbd

mask is the important line. A masked service can’t be started by hand, by another unit, or by a package update re-enabling it. Run the ss check again afterwards; it should print nothing for 445.

To put it back once your distribution ships a fixed kernel:

sudo systemctl unmask ksmbd
sudo systemctl enable --now ksmbd

If people do use those shares, you can either move them to Samba first, or at least restrict port 445 at the firewall to the machines that need it. The no-login bug only needs a TCP connection.

The usual module block doesn’t work here

The standard way to keep a kernel module from loading is a file in /etc/modprobe.d/:

install ksmbd /bin/false

That line tells modprobe to run /bin/false instead of loading the module. On Ubuntu 26.04 it doesn’t stop ksmbd. With that file in place, sudo modprobe ksmbd loaded the module anyway and returned success.

The reason is that ksmbd declares soft dependencies on seven crypto and language modules, which you can see with:

modinfo -F softdep ksmbd

The version of kmod Ubuntu 26.04 ships (34.2) skips install lines for any module that has soft dependencies. I checked that it isn’t something about ksmbd: the dummy network module honors the install line, and stops honoring it as soon as I give it a soft dependency of its own.

blacklist ksmbd doesn’t help either. A blacklist only stops a module loading automatically, and ksmbd.service loads it on purpose. I haven’t tested other kmod versions, so if you rely on install lines for other modules on 26.04, check whether those modules have soft dependencies too.

Masking the service holds because it removes the only thing that turns the module into a server. I rebooted the lab machine with the service masked: the module didn’t load and port 445 stayed closed.

Doing this across a fleet

The RFF Script Library has two Linux entries for this. KSMBD (ZDI-CAN-33774/33549) - Exposure Check reports each machine as EXPOSED (the kernel is serving on 445), loaded, available, blocked or not present, with its shares and any RDMA devices. Samba listening on 445 is never counted as KSMBD. Block KSMBD does the three commands above, checks that nothing in the kernel is still listening on 445, and keeps a record so its undo puts the service back exactly as it was. Both are tested on Ubuntu 26.04 and Rocky 9.8.

RFF is free for your first 100 endpoints: getrff.com.

Sources

Comments

Comments use GitHub Discussions, so you'll need a GitHub account to post. Corrections are especially welcome.