ZDI 2026-09-14

ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

CVE-2026-64397

Machine-generated analysis · WAYSCloud LLM

Remote code execution is possible without authentication on Linux kernels with KSMBD enabled.

Context

The advisory concerns the Linux Kernel KSMBD component. It describes a race condition in the Query Directory request that enables remote code execution. The advisory notes that authentication is not required to exploit the flaw. Only systems with KSMBD enabled are affected.

Operator considerations

Check: Verify whether KSMBD is enabled on Linux kernel installations.
Isolate: Consider disabling KSMBD on affected systems until a fix is available.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. Furthermore, only systems with KSMBD enabled are vulnerable. The ZDI has assigned a CVSS rating of 9.0. The following CVEs are assigned: CVE-2026-64397.

Read the full advisory on ZDI →