CVE-2025-38501
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client connections. This patch limit repeated connections from clients with the same IP.
Analysis
The ksmbd file server in the Linux kernel is vulnerable to a connection exhaustion denial-of-service attack where a malicious actor can repeatedly establish connections from the same IP address to exhaust available connection slots, preventing legitimate clients from connecting. A proof-of-concept exploit tool called 'KSMBDrain' is publicly available on GitHub, demonstrating active weaponization of this vulnerability. The EPSS score of 0.02% indicates very low observed exploitation in the wild despite POC availability, though the CVSS score of 7.5 (High) reflects significant availability impact.
Technical Context
ksmbd is an in-kernel SMB server implementation for the Linux kernel that provides file sharing services. The vulnerability stems from CWE-400 (Uncontrolled Resource Consumption), where the server fails to implement proper connection rate limiting or per-IP connection quotas. Affected products include multiple Linux kernel versions as indicated by CPE strings for linux:linux_kernel and debian:debian_linux 11.0. Without connection limiting controls, an attacker can monopolize the server's connection pool by establishing numerous connections from a single source IP, leading to resource exhaustion that blocks legitimate users from accessing the service.
Affected Products
Multiple versions of the Linux kernel are affected as indicated by the CPE identifiers cpe:2.3:o:linux:linux_kernel. Debian GNU/Linux 11.0 (cpe:2.3:o:debian:debian_linux:11.0) is also confirmed affected, with Debian issuing an advisory on their LTS announcement list at https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html. The vulnerability impacts Linux kernel versions that include the ksmbd in-kernel SMB server implementation. Specific version ranges are documented in the kernel.org stable tree patches referenced.
Remediation
Apply the available kernel patches from the Linux stable tree immediately. Six patches are available at https://git.kernel.org/stable/c/6073afe64510c302b7a0683a01e32c012eff715d, https://git.kernel.org/stable/c/7e5d91d3e6c62a9755b36f29c35288f06c3cd86b, https://git.kernel.org/stable/c/cb092fc3a62972a4aa47c9fe356c2c6a01cd840b, https://git.kernel.org/stable/c/e6bb9193974059ddbb0ce7763fa3882bd60d4dc3, https://git.kernel.org/stable/c/f1ce9258bcbce2491f9f71f7882b6eed0b33ec65, and https://git.kernel.org/stable/c/fa1c47af4ff641cf9197ecdb1f8240cbb30389c1. Debian users should follow the guidance at https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html. As an interim mitigation, implement network-level rate limiting or firewall rules to restrict connection attempts per source IP, or consider disabling ksmbd and using alternative file sharing solutions until patching is complete.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today