Two Linux Kernel KSMBD Vulnerabilities Enable Remote Code Execution

• •ZDI-26-693 requires authentication; ZDI-26-684 does not.
• •Both vulnerabilities allow remote code execution on Linux Kernel KSMBD.
• •Linux has issued updates to mitigate these vulnerabilities.

Two vulnerabilities in the Linux Kernel KSMBD have been disclosed, allowing remote attackers to execute arbitrary code. The first vulnerability (ZDI-26-693) requires authentication and affects systems with ksmbd enabled, while the second (ZDI-26-684) does not require authentication and targets systems with KSMBD enabled. Both vulnerabilities stem from improper locking mechanisms in the handling of specific objects, leading to potential code execution in the kernel context. Linux has issued updates to address these vulnerabilities. The vulnerabilities were reported to the vendor on different dates, with both advisories released on September 14, 2026. The lack of authentication in the second vulnerability raises its severity, as it could be exploited more easily. Organizations using affected Linux Kernel versions should prioritize applying the patches.