My understanding is that ksmbd is a kernel-space SMB server "developed as a lightweight, high-performance alternative" to the traditional (user-space) Samba server...
Q1: Who is using ksmbd in production?
Q2: Why?
I used o3 to find a remote zeroday in the Linux SMB implementation
11–20 of 232 posts
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#12My understanding is that ksmbd is a kernel-space SMB server "developed as a lightweight, high-performance alternative" to the traditional (user-space) Samba server... Q1: Who is using ksmbd in production? Q2: Why?
I would assume for the reason of being lightweight and high performance?
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#13The article cites a signal to noise ratio of ~1:50. The author is clearly deeply familiar with this codebase and is thus well-positioned to triage the signal from the noise. Automating this part will be where the real wins are, so I'll be watching this closely.
1:50 is a great detection ratio for finding a needle in a haystack.
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#14The article cites a signal to noise ratio of ~1:50. The author is clearly deeply familiar with this codebase and is thus well-positioned to triage the signal from the noise. Automating this part will be where the real wins are, so I'll be watching this closely.
I was thinking about this the other day, wouldn't it be feasible to make fine-tune or something like that into every git change, mailist, etc, the linux kernel has ever hard? Wouldn't such an LLM be the closer -synth- version of a person who has worked on a codebase for years, learnt all its quirks etc. There's so much you can fit on a high context, some codebases are already 200k Tokens just for the code as is, so i…
I'd be willing to bet the sum of all code submitted via patches, ideas discussed via lists, etc doesn't come close to the true amount of knowledge collected by the average kernel developer's tinkering, experimenting, etc that never leaves their computer. I also wonder if that would lead to overfitting: the same bugs being perpetuated because they were in the training data.
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#15The most interesting and significant bit of this article for me was that the author ran this search for vulnerabilities 100 times for each of the models. That's significantly more computation than I've historically been willing to expend on most of the problems that I try with large language models, but maybe I should let the models go brrrrr!
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#16My understanding is that ksmbd is a kernel-space SMB server "developed as a lightweight, high-performance alternative" to the traditional (user-space) Samba server... Q1: Who is using ksmbd in production? Q2: Why?
I would assume for the reason of being lightweight and high performance?
Smb over 25gbit networks - user space samba is much worse there.
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#17Earlier quoted context omitted.
I would assume for the reason of being lightweight and high performance?
Smb over 25gbit networks - user space samba is much worse there.
This is interesting to me! I regularly deploy 25G network connections, but I don’t think we’d run SMB over that. I am super curious the industry and use case if you’re willing to share!
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#18The article cites a signal to noise ratio of ~1:50. The author is clearly deeply familiar with this codebase and is thus well-positioned to triage the signal from the noise. Automating this part will be where the real wins are, so I'll be watching this closely.
Exactly. Many AI users can’t triage effectively, as a result open source projects get a lot of spam now: https://arstechnica.com/gadgets/2025/05/open-source-project-...
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#19Meanwhile, as a maintainer, I've been reviewing more than a dozen false positives slop CVEs in my library and not a single one found an actual issue. This article's is probably going to make my situation worse.
Re: I used o3 to find a remote zeroday in the Linux SMB implementation
#20Wow, interesting. I been hacking a tool called https://diffwithgpt.com with a similar angle but indexing git changelogs with qwen to have it raise risks for backward compat issues, risks including security when upgrading k8s etc.