Two CVSS 9.0 RCE flaws in KSMBD go public before any Linux kernel fix exists

On October 22, 2026, two remote code execution flaws rated CVSS 9.0 by Trend Micro’s Zero Day Initiative affect KSMBD, the SMB server built into the Linux kernel, with no fix in the mainline kernel. One triggers before any network authentication on port 445: check now whether the module is loaded on your servers.