Based on the description, it is inferred that the Linux kernel’s ksmbd component allows an authenticated client to send numerous structurally valid but unmapped Security Identifiers (SIDs) in a DACL. Each unmapped SID triggers a kernel error log entry. This reflects a CWE-770 weakness of excessive resource consumption. When the rate limiting for these log messages is removed, a single request can produce hundreds of error logs, potentially exhausting kernel log buffers and degrading system performance. The vulnerability does not grant arbitrary code execution or privilege escalation, but it can disrupt normal operation by flooding the kernel log and exhausting log space.

This flaw exists in the Linux kernel. No specific kernel version is listed in the advisory, so any kernel that implements ksmbd and lacks the recent rate‑limiting fix is potentially affected. The vulnerability is vendor‑agnostic, affecting all distributions that ship the unpatched kernel.

The CVE is not listed in CISA’s KEV catalog. The EPSS score is <1%, indicating a low likelihood of exploitation in the wild. The CVSS score of 5.5 classifies the vulnerability as moderate severity. Nevertheless, because the attacker must have authenticated access, as inferred from the description, an insider or compromised user could intentionally flood logs to cause denial of service. The impact on availability could be significant on low‑resource or high‑security systems where log space is constrained. This resource exhaustion scenario remains a risk for administrators who depend on kernel log stability.