ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability
Published Sep 14, 2026
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. Furthermore, only systems with KSMBD enabled are vulnerable. The ZDI has assigned a CVSS rating of 9.0. The following CVEs are assigned: CVE-2026-64397.
Affected Software
1 affected component
Linux kernel ksmbd
Event History
Sep 14, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Which systems are exposed to this issue?
Only Linux systems with KSMBD enabled are vulnerable. Systems without KSMBD enabled are not affected according to the advisory.
2
Does an attacker need credentials or prior access?
No. The vulnerability can be exploited remotely without authentication, allowing an unauthenticated attacker to execute arbitrary code on an affected KSMBD-enabled system.
3
What is the assigned CVE and severity?
The issue is assigned CVE-2026-64397. ZDI assigned it a CVSS score of 9.0.