ZDI-26-998: Linux Kernel KSMBD SMB Direct Integer Underflow Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Linux Kernel KSMBD component when SMB Direct is enabled. This integer underflow flaw can be exploited by remote attackers to execute arbitrary code. Exploitation may require authentication depending on system configuration. The vulnerability has a high severity rating assigned by ZDI.

• zerodayinitiative.com/advisories/ZDI-26-998/ (opens in a new tab)

• ZDI-26-990: open62541 Subscription Use-After-Free Remote Code Execution VulnerabilityHighVulnerability2026-11-13
• ZDI-26-991: Hinemos Agent Improper Certificate Validation Remote Code Execution VulnerabilityHighVulnerability2026-11-13
• ZDI-26-994: SmarterTools SmarterMail File Edit API Directory Traversal Remote Code Execution VulnerabilityHighVulnerability2026-11-13
• ZDI-26-975: llama.cpp GGUF File Parsing Integer Overflow Remote Code Execution VulnerabilityHighVulnerability2026-11-13
• ZDI-26-976: llama.cpp GGUF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityHighVulnerability2026-11-13