EUVD-2026-86944
GHSA-vpc3-747g-g72v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to ksmbd SMB service
-
DeliveryCraft DACL with many unmapped SIDs
-
ExploitSubmit ACL-bearing request
-
ExecutionEach SID triggers unthrottled kernel log error
-
ImpactFlood kernel log and degrade availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target host has the in-kernel ksmbd SMB server enabled and a share exposed to clients (not a default configuration on most Linux systems, which use userspace Samba or no SMB server at all), and that the attacker holds a valid authenticated SMB session (PR:L). The concrete trigger is a client-supplied DACL containing numerous structurally valid but unmapped SIDs, each of which, pre-patch, produced an unthrottled kernel error log entry. Limiting factors: authentication is required, ksmbd must be running and reachable, and the realized impact is confined to kernel-log flooding / availability degradation (no confidentiality or integrity impact and no code execution). |
| Impact | This is a low-to-moderate priority issue despite its CWE-770 (uncontrolled resource consumption) classification, and the signals are broadly consistent in pointing to limited real-world risk. EPSS is 0.20% (9th percentile), there is no CISA KEV listing (not KEV), and no public exploit or PoC is referenced - only upstream kernel patch commits. The vuln.today decision label is 'this_month', indicating routine scheduled patching rather than emergency action. The supplied CVSS is 5.5 (medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. There is a notable inconsistency worth verifying: the input vector asserts AV:L (local), yet the description describes the attack as coming from an authenticated SMB 'client' sending a DACL to ksmbd, which is Linux's in-kernel network SMB3 server - that is a network-reachable surface, so AV:L appears to understate reachability while the attack still requires authentication (PR:L). Additionally, the input's A:H seems high for the described impact, which is kernel-log flooding (a partial availability/log-noise degradation), not a full crash or hang. Net: a real but contained authenticated denial-of-availability affecting only systems that actually run ksmbd. |
| Exploit ScenarioDerived | An authenticated user with access to a share served by the in-kernel ksmbd SMB server sends a request whose DACL contains many structurally valid but unmapped SIDs. Because each mapping failure was logged without throttling, a single request can emit hundreds of kernel error messages, flooding the kernel log and degrading the host. No public exploit code or PoC is identified; the referenced links are upstream patch commits, not working exploits. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Kernel-log flooding in the Linux kernel's in-kernel ksmbd SMB3 server lets an authenticated SMB client degrade host availability by submitting a single DACL containing many structurally valid but unmapped SIDs, each of which previously produced an unthrottled kernel error message. Only systems that have enabled ksmbd and exposed a share are affected (not a default configuration on most distributions, which ship userspace Samba or no SMB server), and the attacker must already hold a valid SMB session, so the practical exposure is narrow; realized impact is limited to availability/log degradation with no confidentiality, integrity, or code-execution consequence. EPSS is low (0.20%, 9th percentile), the issue is not listed in CISA KEV, and the flaw is not known to be actively exploited; vendor patches are available in the listed stable kernel releases. A public fix commit exists upstream, but no verified working exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to Linux 6.12.111, 6.18.53, 7.2.7 or 7.3-rc2 (or later) on the affected branch, which incorporates the rate limiting of unmapped-SID error logging; the corresponding upstream stable commits are https://git.kernel.org/stable/c/13af319c1efec0b45fb5c1b16830eb0888b3fd1e, https://git.kernel.org/stable/c/30dbb08777b9a611d7d9193c040f382fbd0e7562, https://git.kernel.org/stable/c/54cb2a909996346ac6a8a3beac96c07b3dcba584 and https://git.kernel.org/stable/c/feca5e70fc963b088377b20879e8cd8237c2fd7d, with the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-98113 as the tracking advisory. Because exploitation requires an authenticated SMB session against a host running ksmbd with an exposed share, the most direct compensating control is to not enable ksmbd at all where userspace Samba or no SMB service is used, or to stop and unload the ksmbd module (accepting the loss of kernel-mode SMB service); additionally, restrict SMB access to trusted network segments or specific client hosts at the firewall so unauthenticated or untrusted clients cannot reach the share, at the cost of reduced file-sharing reachability. Kernel-log flooding remains possible on unpatched hosts for any client that can authenticate, so network restriction alone does not remove the resource-consumption path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ksmbd is the SMB3 file server implemented inside the Linux kernel (as opposed to userspace Samba), and it performs access checks against Windows-style security descriptors supplied by clients, including DACLs made up of SIDs. When a client presents a structurally valid SID that cannot be mapped to a local identity, ksmbd logs the mapping failure; because that logging was not throttled, a DACL containing hundreds of unmapped SIDs converts a single SMB request into hundreds of kernel log records. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), and the upstream remedy is to rate limit the unmapped-SID error message so a single authenticated client cannot flood the kernel log. The trigger is described in the sources: a client-supplied DACL with numerous valid-but-unmapped SIDs. Note that the CVSS vector in the source data (AV:L/AC:L/PR:L, A:H) and the independently assessed vector (AV:N/AC:L/PR:L, A:L) differ in attack vector and availability weight; under the assessed view the flaw is network-reachable over SMB by an authenticated session with limited availability impact, requiring ksmbd to be running with an exposed share.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
ksmbd is a network-facing SMB server so AV:N; an authenticated session is required so PR:L; the only impact is kernel-log flooding, a partial availability degradation, so A:L.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: rate limit unmapped SID errors
A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages.
Rate limit the message to prevent an authenticated client from flooding the kernel log.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB