CVE-2026-98113: ksmbd: rate limit unmapped SID errors
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: rate limit unmapped SID errors
A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages.
Rate limit the message to prevent an authenticated client from flooding the kernel log.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Rate-limit logging of unmapped SID mapping failures to prevent an authenticated client from flooding the kernel log.
Linux kernel ksmbd unmapped SID error logging = rate limited
Event History
Frequently Asked Questions
Who can trigger the excessive kernel logging?
An authenticated client that can submit a DACL containing many structurally valid SIDs that are not mapped by the server can trigger the logging behavior.
What is the practical impact of exploitation?
A single request can generate hundreds of kernel error messages, allowing an authenticated client to flood the kernel log.
What change addresses the issue?
The resolved change rate-limits error messages for unmapped SID mapping failures, preventing every failure in a large DACL from being logged.