ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

Zerodayinitiative • September 14, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. Furthermore, only systems with KSMBD enabled are vulnerable.

The specific flaw exists within the handling of dir_fp objects. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.

Linux has issued an update to correct this vulnerability. More details can be found at:

2026-06-11 - Vulnerability reported to vendor

2026-09-14 - Coordinated public release of advisory

2026-09-14 - Advisory Updated

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Two Linux Kernel KSMBD Vulnerabilities Enable Remote Code Execution Two vulnerabilities in the Linux Kernel KSMBD have been disclosed, allowing remote attackers to execute arbitrary code. The first vulnerability (ZDI-26-693) requires authentication and affects systems with ksmbd enabled, while the second (ZDI-26-684) does not require authentication and targets systems with KSMBD enabled. Both vulnerabilities stem from improper locking mechanisms in the handling of specific objects, leading to potential code execution in the kernel context. Linux has issued updates to address these vulnerabilities. The vulnerabilities were reported to the vendor on different dates, with both advisories released on September 14, 2026. The lack of authentication in the second vulnerability raises its severity, as it could be exploited more easily. Organizations using affected Linux Kernel versions should prioritize applying the patches. 2 sources 58

Extracted Entities

ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

Platforms (1)