CVE-2026-98113
Received Received - Intake

ksmbd Kernel Log Flooding via Unmapped SID Errors

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to prevent an authenticated client from flooding the kernel log.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98113
EUVD
EUVD-2026-86944

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves ksmbd, a SMB server implementation. An authenticated client can send many valid but unmapped Security Identifiers (SIDs) in a Discretionary Access Control List (DACL). The kernel logs each mapping failure, causing excessive error messages that flood the kernel log.

Detection Guidance

This vulnerability involves excessive kernel log messages from unmapped SIDs in ksmbd. Check kernel logs for repeated SID mapping failures using commands like 'dmesg | grep -i sids' or 'journalctl -k | grep -i sids'. Look for high frequency of these errors which may indicate exploitation attempts.

Impact Analysis

This vulnerability allows an authenticated client to generate excessive kernel log entries, potentially causing system slowdowns or log storage issues. It may also obscure other important log messages due to the flood of error logs.

Mitigation Strategies

Update the Linux kernel to the patched version that includes the rate limiting fix. Monitor kernel logs for SID mapping errors to identify potential attack patterns. If immediate patching isn't possible, consider temporarily disabling ksmbd services until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98113. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart