Oktyabr oyida bir nechta tuzatilmagan Linux zaifliklari ommaviy pochta ro'yxatlarida oshkor qilindi, bu esa texnik tafsilotlar tuzatishlar keng tarqalmaganidan oldin e'lon qilinganini ko'rsatdi.
Bu oshkor qilishlar KSMBD'dagi ikkita muhim xatoni o'z ichiga oldi, ular masofadan hujum qiluvchilarga kod bajarish imkonini berishi mumkin, shuningdek, imtiyozlarni oshirish va ma'lumotlarni oshkor qilish haqidagi hisobotlar ham bor edi.
Trend Micro'ning Zero Day Initiative (ZDI) hisobotlarini taqdim etdi, bu esa Linux yadrosi saqlovchisi Greg Kroah-Hartmanni bu zaifliklar nima uchun tuzatishlarsiz e'lon qilinganini so'rashga undadi. Biroq, oshkor qilishlar tasodifiy bo'lganligi hali tasdiqlanmagan.
Hisobotlarda zaifliklarni aniqlashda Trend Micro'ning sun'iy intellekt skaneri kredit berilgan, yangilangan yadro yo'riqnomasi esa sun'iy intellekt tomonidan topilgan xatolar allaqachon ommaviy deb hisoblanishini ko'rsatadi. 2026-yil 23-oktyabr holatiga ko'ra, ZDI o'z taqdimot qarorlarini ommaviy ravishda tushuntirmagan.
CSN ma'lumotlariga ko'ra, eng jiddiy ikkita zaiflik Linux yadrosidagi ixtiyoriy SMB fayl serveri bo'lgan KSMBD'ga ta'sir qiladi. KSMBD Samba'dan farq qiladi, shuning uchun faqat Samba'dan foydalanadigan tizimlar bu muammolardan avtomatik ravishda ta'sirlanmaydi.
- ZDI-CAN-33774: CVSS 9.0 baholangan bu zaiflik navbatga qo'yilgan tarmoq so'rovlari bilan bog'liq poyga shartini o'z ichiga oladi. Oshkor qilishda so'rovlarni nomuvofiq qayta ishlash xotira chegarasidan tashqariga chiqishga olib kelishi mumkinligi, bu esa masofadan kod bajarish imkonini berishi mumkinligi ko'rsatilgan.
- ZDI-CAN-33549: Shuningdek, CVSS 9.0 baholangan bu muammo KSMBD'ning SMB Direct amalga oshirishiga ta'sir qiladi. Butun sonning pastga tushishi noto'g'ri uzunlik qiymatini hosil qiladi, bu esa keyingi xotira operatsiyalarining bufer chegaralaridan oshib ketishiga sabab bo'ladi. Ta'sir server konfiguratsiyasiga va SMB Direct funksiyasi yoqilganligiga bog'liq.
Ikkinchi zaiflik uchun tuzatish Linux 7.5 ga mo'ljallangan ishlab chiqish shoxasida mavjudligi xabar qilingan. Biroq, tuzatishning ishlab chiqish shoxasida mavjudligi chiqarilgan yadrolar yoki tarqatish paketlarida bu tuzatish mavjudligini kafolatlamaydi.
Hisobot berilgan vaqtda, hech bir muhim zaiflik asosiy yadro yoki uning integratsiya daraxtida aniqlangan tuzatishga ega emas edi, shuningdek, ularga CVE identifikatori ham berilmagan edi.
Boshqa to'rtta oshkor qilish turli hujum yuzalarini tafsilotlaydi:
- ZDI-CAN-33367: skb_zerocopy tarmoq kodini o'z ichiga oladi va mahalliy imtiyozlarni oshirishga imkon berishi mumkin. Ishlab chiquvchilar avvalroq mustaqil hisobot olganlari va tuzatish ustida ishlayotganlari xabar qilingan.
- ZDI-CAN-34068: VMware grafik drayveridagi chegaradan tashqari yozishni o'z ichiga oladi, bu esa mahalliy hujumchiga imtiyozlarni oshirish imkonini berishi mumkin.
- ZDI-CAN-34076: NVMe over Fabrics maqsadli amalga oshirishidagi boshlang'ich resursni tavsiflaydi, bu esa ma'lumot oshkor bo'lishiga olib kelishi mumkin.
- ZDI-CAN-32005: ConnMan'ning qidiruv domeni TCP so'rovlari bilan ishlashidagi stek-bufer to'lib ketishini hal qiladi. ConnMan foydalanuvchi maydonidagi tarmoqni boshqarish xizmati bo'lib, yadro komponenti emas.
Administratorlar avvalo KSMBD yoqilganligini tekshirishlari va uning zarurligini baholashlari kerak. Foydalanilmayotgan KSMBD funksiyasini o'chirish xabar qilingan masofadan kod bajarish zaifliklariga ta'sirni minimallashtirishga yordam beradi.
Agar KSMBD zarur bo'lsa, fayl almashish kirishini ishonchli tarmoqlarga cheklang, ulush ruxsatlarini ko'rib chiqing va SMB Direct ta'sirini baholang. Yuqori darajadagi ishlab chiqish o'zgarishlari joylashtirilgan tizimlarga qo'llanilgan deb taxmin qilish o'rniga tarqatish xavfsizlik maslahatlarini kuzating.
Ommaviy texnik tafsilotlar himoyachilarga yordam berishi mumkin bo'lsa-da, ular tuzatishlar mavjud bo'lmaguncha hujumchilarga ham ma'lumot berishi mumkin. Shuning uchun, sotuvchi tomonidan tasdiqlangan yangilanishlarni tezda qo'llang; faqat tarmoq cheklovlariga tayanish to'g'ri tuzatishlar o'rnini bosa olmaydi.
In October, several unpatched Linux vulnerabilities were disclosed on public mailing lists, revealing technical details before fixes were widely available.
These disclosures included two critical flaws in KSMBD that could let remote attackers execute code, along with reports of privilege escalation and information disclosure.
Trend Micro’s Zero Day Initiative (ZDI) submitted the reports, prompting Linux kernel maintainer Greg Kroah-Hartman to question why these vulnerabilities were published without accompanying patches. However, it remains unconfirmed whether the disclosures were accidental.
The reports credit Trend Micro’s AI scanner for identifying the vulnerabilities, while updated kernel guidance suggests that AI-discovered bugs are treated as already public. As of October 23, 2026, ZDI had not publicly clarified its submission decisions.
According to CSN, the two most severe vulnerabilities affect KSMBD, the optional SMB file server in the Linux kernel. KSMBD is distinct from Samba, so systems using Samba alone are not automatically affected by these issues.
- ZDI-CAN-33774: Rated CVSS 9.0, this vulnerability involves a race condition with queued network requests. The disclosure indicates that inconsistent request handling could lead to out-of-bounds memory access, potentially enabling remote code execution.
- ZDI-CAN-33549: Also rated CVSS 9.0, this issue affects KSMBD’s SMB Direct implementation. An integer underflow can produce an incorrect length value, causing subsequent memory operations to exceed buffer limits. Exposure depends on the server’s configuration and whether SMB Direct functionality is enabled.
A fix for the second vulnerability is reportedly available in a development branch targeting Linux 7.5. However, the existence of a fix in a development branch does not guarantee that released kernels or distribution packages contain this correction.
At the time of reporting, neither critical vulnerability had a fix identified in the mainline kernel or its integration tree, nor had they been assigned a CVE identifier.
There are four other disclosures detailing different attack surfaces:
- ZDI-CAN-33367: Involves the skb_zerocopy networking code and could enable local privilege escalation. Developers have reportedly received an independent report earlier and are working on a patch.
- ZDI-CAN-34068: Concerns an out-of-bounds write in the VMware graphics driver, potentially allowing a local attacker to elevate privileges.
- ZDI-CAN-34076: Describes an uninitialized resource in the NVMe over Fabrics target implementation, which could lead to information exposure.
- ZDI-CAN-32005: Addresses a stack-buffer overflow in ConnMan’s handling of search-domain TCP queries. ConnMan is a user-space network management service and not a kernel component.
Administrators should first check whether KSMBD is enabled and assess whether it’s necessary. Disabling unused KSMBD functionality can help minimize exposure to the reported remote-code-execution vulnerabilities.
If KSMBD is required, restrict file-sharing access to trusted networks, review share permissions, and evaluate SMB Direct exposure. Monitor distribution security advisories instead of assuming upstream development changes have been applied to deployed systems.
While public technical details can help defenders, they can also give attackers information before patches are available. Therefore, apply vendor-approved updates promptly; relying solely on network restrictions is not a substitute for proper fixes.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.