Vulnerabilities
Linux Kernel ksmbd Share Configuration Race Condition Enables Remote Code Execution
A race condition in the Linux kernel’s ksmbd share configuration allows authenticated remote attackers to execute arbitrary code. Only systems with ksmbd enabled are affected; the CVSS score is 8.5. Defenders should patch the kernel or disable ksmbd if not required.
What Happened
A race condition in the handling of share_conf objects within the ksmbd module of the Linux kernel permits authenticated attackers to trigger a kernel‑level code execution. The flaw arises from missing locking when manipulating share configuration data.
Impact
- Severity: CVSS 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Only systems with ksmbd enabled are vulnerable.
- Requires authentication but allows execution with kernel privileges.
Mitigation
- Apply the official kernel update that includes commit 5258572aa5fd5a7ed01b123b28241e0281b6fb9b.
- If a patch is not immediately available, disable ksmbd by removing the module or setting the appropriate sysctl to prevent its activation.
- Verify the kernel version with
uname -rand ensure it does not contain the vulnerable commit range.
Detection
- Check for the presence of ksmbd:
lsmod | grep ksmbd. - Audit kernel logs for abnormal syscalls or privilege escalations that could indicate exploitation attempts.
Related vulnerabilities
Linux Kernel KSMBD Directory Query Race Condition Enables Remote Code Execution
A race condition in the Linux kernel’s KSMBD component allows unauthenticated attackers to execute arbitrary code. The flaw exists only on systems with KSMBD enabled and carries a CVSS score of 9.0. Linux has released a patch; administrators should update immediately.
Read briefing
Linux Kernel OpenvSwitch Race Condition Enables Local Privilege Escalation (CVE‑2026‑74465)
A race condition in the Linux kernel’s OpenvSwitch dp_meter handling allows local attackers to gain root privileges after executing low‑privileged code. The flaw is fixed in a kernel commit and requires immediate patching. Defenders should update kernels, audit OpenvSwitch usage, and monitor for suspicious dp_meter activity.
Read briefing
Linux Kernel eMPIA USB Driver Race Condition Enables Kernel Code Execution (CVE‑2026‑31583)
A race condition in the Linux kernel’s eMPIA USB device driver allows a physically present attacker to execute arbitrary code in kernel context without authentication. The flaw, rated CVSS 7.1, stems from missing locking on em28xx_v4l2 structures. Defenders should apply the kernel patch (commit a66485a934c7187ae8e36517d40615fa2e961cff) or update to a patched distribution version and consider disabling unused USB devices.
Read briefing
Microsoft Edge Vulnerability CVE‑2026‑106412: Race Condition in Chromium
A race condition in Chromium (CVE‑2026‑106412) affects Microsoft Edge users. The flaw can enable arbitrary code execution via malicious web content. Defenders should update Edge to the patched version and monitor for suspicious activity.
Read briefing