Two remote code execution flaws in KSMBD, the in-kernel SMB3 server built into Linux, each carry a CVSS score of 9.0, according to reporting from thehackernews.com dated October 22, 2026. The outlet's account is the only record located in this review. No kernel.org advisory, patch commit, or vendor bulletin confirming a fix has been found as of this writing.
KSMBD sits inside the kernel itself, not as a userspace daemon like Samba, which means a successful exploit runs with kernel-level reach rather than the restricted privileges of an ordinary service. That architecture is what turns an SMB implementation bug into a 9.0-class event: file sharing is a common default on Linux-based NAS boxes, container hosts, and internal file servers, and any system that mounts or serves SMB shares over KSMBD is a plausible target until patched.
What the report does not establish is as consequential as what it does. The specific vulnerable kernel versions, the CVE identifiers, and any vendor timeline for a backported fix were not disclosed in the available reporting. Whether distributions have already pulled KSMBD from default kernel configs, or whether cloud providers running custom kernels are affected, is likewise absent from the record. That gap matters because a 9.0 score without a confirmed patch date tells an operator there is danger, not yet how to close it.
For anyone moving data across SMB-mounted shares, the immediate checklist starts with inventory: confirm whether KSMBD is loaded as a kernel module on file servers, backup targets, or data transfer nodes, since Samba-only deployments are not implicated by this specific flaw. Pipelines that stage files through SMB mounts before ingestion should treat those mounts as a trust boundary pending a fix, and any automated job account with write access to a KSMBD share deserves a review of its blast radius. Format and payload integrity are not in question here, authentication and kernel memory safety are, so the usual data validation steps do nothing to mitigate this.
Interoperability is where the quiet risk sits. SMB remains a common handoff point between Linux and Windows environments in mixed-OS data estates, and a kernel-level SMB bug does not respect which side initiated the connection. Until an official patch or advisory surfaces, operators should assume exposure extends to any Linux host serving SMB regardless of what connects to it. The absence of a published CVE or fix commit as of November 2 leaves teams working from a severity number and a publication date, nothing more, and that asymmetry is itself the story worth tracking into the next advisory cycle.