Critical Remote Code Execution in Linux Kernel KSMBD (CVE‑2026‑64397) via Directory‑Query Race Condition
What It Is – A race‑condition flaw in the Linux kernel’s KSMBD service allows an unauthenticated remote attacker to execute arbitrary code in kernel context. The defect stems from missing locking around dir_fp objects during directory‑query handling.
Exploitability – CVSS 9.0 (Critical). The vulnerability is network‑accessible, requires no authentication, and a proof‑of‑concept exploit has been published. No public exploits are known yet, but the risk of rapid weaponisation is high.
Affected Products – Linux kernel builds with the KSMBD (Kernel SMB Daemon) feature enabled.
Why It Matters for Trust & Control Assurance
- Patch Management – Demonstrating timely patching of kernel components is a core control objective that satisfies multiple frameworks (e.g., NIST CSF, ISO 27001).
- Continuous Monitoring – Detecting the presence of KSMBD and confirming its version provides audit‑ready evidence that the environment is protected.
- Defensible Evidence – Maintaining records of remediation actions (patch applied, KSMBD disabled if unused) creates a traceable audit trail for regulators and enterprise buyers.
Recommended Actions
- Deploy the Linux kernel update that disables the race condition (see the upstream commit).
- If KSMBD is not required, disable the service entirely to reduce attack surface.
- Update your asset inventory and vulnerability scanners to flag KSMBD‑enabled hosts.
- Log and monitor for anomalous SMB‑related traffic that could indicate exploitation attempts.
- Capture remediation evidence (patch version, service state) for compliance reporting.