ksmbd CVE-2026-98113

Exploitation requires that the target host has the in-kernel ksmbd SMB server enabled and a share exposed to clients (not a default configuration on most Linux systems, which use userspace Samba or no SMB server at all), and that the attacker holds a valid authenticated SMB session (PR:L). The concrete trigger is a client-supplied DACL containing numerous structurally valid but unmapped SIDs, each of which, pre-patch, produced an unthrottled kernel error log entry. Limiting factors: authentication is required, ksmbd must be running and reachable, and the realized impact is confined to kernel-log flooding / availability degradation (no confidentiality or integrity impact and no code execution).

This is a low-to-moderate priority issue despite its CWE-770 (uncontrolled resource consumption) classification, and the signals are broadly consistent in pointing to limited real-world risk. EPSS is 0.20% (9th percentile), there is no CISA KEV listing (not KEV), and no public exploit or PoC is referenced - only upstream kernel patch commits. The vuln.today decision label is 'this_month', indicating routine scheduled patching rather than emergency action. The supplied CVSS is 5.5 (medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. There is a notable inconsistency worth verifying: the input vector asserts AV:L (local), yet the description describes the attack as coming from an authenticated SMB 'client' sending a DACL to ksmbd, which is Linux's in-kernel network SMB3 server - that is a network-reachable surface, so AV:L appears to understate reachability while the attack still requires authentication (PR:L). Additionally, the input's A:H seems high for the described impact, which is kernel-log flooding (a partial availability/log-noise degradation), not a full crash or hang. Net: a real but contained authenticated denial-of-availability affecting only systems that actually run ksmbd.

An authenticated user with access to a share served by the in-kernel ksmbd SMB server sends a request whose DACL contains many structurally valid but unmapped SIDs. Because each mapping failure was logged without throttling, a single request can emit hundreds of kernel error messages, flooding the kernel log and degrading the host. No public exploit code or PoC is identified; the referenced links are upstream patch commits, not working exploits.