Two critical remote code execution (RCE) vulnerabilities, rated CVSS 9.0, have been publicly disclosed in Linux KSMBD, the kernel’s built-in SMB server. These flaws, ZDI-CAN-33774 and ZDI-CAN-33549, currently lack official fixes in the mainline kernel. One vulnerability can be triggered pre-authentication, while the other requires SMB Direct transport. The public disclosure before patches creates a significant window of exposure for Linux servers running KSMBD.