ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability
ZDI discloses CVE-2026-64397, a CVSS 9.0 unauthenticated remote code execution race condition in Linux Kernel KSMBD.
ZDI-26-684 describes a race condition in the Linux Kernel KSMBD subsystem's Query Directory Request handling that allows unauthenticated remote attackers to execute arbitrary code. Only systems with KSMBD enabled are vulnerable. ZDI assigned a CVSS rating of 9.0 and CVE-2026-64397.
- Unauthenticated remote code execution via KSMBD Query Directory Request race condition
- CVSS 9.0; only systems with KSMBD enabled are affected
- Tracked as CVE-2026-64397 (ZDI-26-684)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64397 | Linux kernel: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated… | 9.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. Furthermore, only systems with KSMBD enabled are vulnerable.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.