CVE-2026-99278
Description
A flaw was found in the Linux kernel's ksmbd, an in-kernel SMB (Server Message Block) server. The session management mechanism only limited pending authentication attempts rather than enforcing a limit on established sessions per connection. A remote authenticated client could exploit this flaw by repeatedly completing authentication to retain an unbounded number of valid sessions on a single connection. This excessive allocation can exhaust system memory, leading to a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate severity because exploitation requires an authenticated client with valid credentials and results strictly in resource exhaustion and denial of service, without impacting system confidentiality or integrity. In Red Hat Enterprise Linux environments, SMB file sharing is conventionally handled by user-space Samba implementations rather than the kernel-space ksmbd module, which is not activated in standard deployments. As a result, systems are only exposed if the administrator has intentionally enabled and configured the in-kernel SMB server.
Mitigation
To mitigate this issue on systems where the in-kernel SMB server is not needed, prevent the ksmbd kernel module from loading:
1. Disable loading of the ksmbd module:
# echo "install ksmbd /bin/true" > /etc/modprobe.d/disable-ksmbd.conf
2. If the module is currently loaded, unload it:
# modprobe -r ksmbd
Alternatively, if ksmbd is run as a system service, stop and mask it:
# systemctl stop ksmbd
# systemctl mask ksmbd
Warning: Unloading the module or stopping the service terminates all active SMB connections handled by ksmbd. If the kernel module is actively held in use by running processes, a system reboot may be required to completely unload it.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
