ZDI-CAN-30527: ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability
Published Sep 14, 2026
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. Furthermore, only systems with KSMBD enabled are vulnerable. The ZDI has assigned a CVSS rating of 9.0. The following CVEs are assigned: CVE-2026-64397.
Affected Software
1 affected component
Linux kernel ksmbd
Event History
Sep 14, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Which systems are exposed to this issue?
Only Linux systems with the kernel KSMBD service enabled are vulnerable. Systems without KSMBD enabled are not affected based on the available information.
2
Does exploitation require valid credentials or prior access?
No. The vulnerability can be exploited remotely without authentication, so any reachable KSMBD service may be exposed to unauthenticated attackers.
3
What is the potential impact of successful exploitation?
A remote attacker can execute arbitrary code on an affected Linux system.