Linux Kernel ksmbd Vulnerability Allows Remote Code Execution
A race condition in the Linux Kernel's ksmbd component, ZDI-26-693, allows authenticated remote attackers to execute arbitrary code.
A critical vulnerability has been disclosed in the Linux Kernel's ksmbd component, identified as ZDI-26-693. This flaw, a race condition within the handling of share_conf objects, allows authenticated remote attackers to execute arbitrary code on affected systems.
The specific vulnerability arises from a lack of proper locking mechanisms when operations are performed on share_conf objects. This oversight enables an attacker, who has already gained authenticated access to a system, to exploit the condition and achieve code execution within the context of the kernel. The CVSS score for this vulnerability is rated at 8.5, indicating a high severity.
It is important to note that exploitation of ZDI-26-693 requires prior authentication. Furthermore, only systems that have the ksmbd component explicitly enabled are susceptible to this attack. This narrows the potential attack surface, but systems configured with ksmbd remain at significant risk if unpatched.
Linux has already issued an update to address this vulnerability. The fix is detailed in a commit to the Linux kernel repository, specifically commit ID 5258572aa5fd5a7ed01b123b28241e0281b6fb9b. Users and administrators are strongly advised to apply this update as soon as possible to mitigate the risk of exploitation.
The vulnerability was initially reported to the vendor on March 30, 2026. Following a coordinated disclosure process, the advisory was publicly released on September 14, 2026, with an update to the advisory also occurring on the same date. This timeline indicates a standard disclosure process aimed at allowing vendors sufficient time to develop and distribute patches.
The discovery and reporting of this vulnerability are credited to DongHyeon Hwang, also known by the handle kind_killerwhale. Researchers like Hwang play a crucial role in identifying and responsibly disclosing security flaws, contributing to the overall security posture of widely used software like the Linux Kernel.
While the vulnerability requires authentication, its presence in the Linux Kernel, a foundational component of many servers and systems, underscores the ongoing need for vigilance. Administrators should ensure their systems are up-to-date and that unnecessary services, such as ksmbd if not actively used, are disabled to reduce the attack surface.
This new advisory, ZDI-26-684, details a remote code execution vulnerability in Linux Kernel's KSMBD component, specifically a race condition within the handling of dir_fp objects. Unlike the previously reported ZDI-26-693, this vulnerability does not require authentication and affects systems with KSMBD enabled, carrying a CVSS score of 9.0. The vulnerability was reported to the vendor on June 11, 2026, and a public advisory was released on September 14, 2026.