Linux Kernel ksmbd EUVD-2026-19194

Exploitation requires the following specific conditions: (1) The target system must be running the Linux kernel's ksmbd SMB server module - kernels not using ksmbd (e.g., those using only Samba/smbd in userspace) are not affected. (2) ksmbd must be serving a filesystem that does not populate sb->s_uuid (e.g., certain non-standard or pseudo-filesystems lacking a UUID). (3) The attacker must have local access to the system with at minimum low-privilege credentials (PR:L per CVSS vector). Exploitation is limited by the local attack vector (AV:L) - remote unauthenticated attackers cannot directly trigger this without prior foothold. No user interaction is required once conditions are met. The specific SMB protocol query FS_OBJECT_ID_INFORMATION must be issued against an affected ksmbd share to reach the vulnerable code path.

Real-world risk is low-to-moderate and primarily limited to servers running ksmbd on filesystems without a UUID. The CVSS base score of 5.5 (Medium) reflects a local attack vector with low privilege requirements - an attacker must already have local system access, significantly limiting the exposed attack surface. EPSS at 0.01% (1st percentile) indicates near-zero probability of exploitation in the wild, consistent with the absence of KEV listing and no identified public exploit code. The High availability impact (A:H) suggests a potential kernel crash or panic, which would be severe for production servers. However, the local attack vector (AV:L) and requirement for low privileges (PR:L) mean exploitation requires pre-existing foothold on the server. Notably, the vendor tags label this 'Information Disclosure,' which conflicts with the CVSS vector (C:N - no confidentiality impact) - this discrepancy should be verified with the upstream advisory; the CVSS vector is treated as authoritative here. The real priority is patch application on ksmbd-enabled servers, particularly those exposed to multi-tenant or untrusted local user environments.

A local user with low-level privileges on a Linux server running ksmbd issues SMB FS_OBJECT_ID_INFORMATION queries against a share backed by a filesystem that does not expose a UUID. The ksmbd handler fails to safely resolve the volume identifier, triggering a kernel-level fault that results in a system crash or denial of service, taking down all services on the host. No public exploit code has been identified at time of analysis.