Skip to main content

Linux Kernel ksmbd CVE-2025-68246

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Remote, low-complexity, unauthenticated socket-leak reachable on TCP/445 with no user interaction; impact is availability exhaustion only, hence C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:18 vuln.today
CVE Published
Dec 16, 2025 - 15:15 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: close accepted socket when per-IP limit rejects connection

When the per-IP connection limit is exceeded in ksmbd_kthread_fn(), the code sets ret = -EAGAIN and continues the accept loop without closing the just-accepted socket. That leaks one socket per rejected attempt from a single IP and enables a trivial remote DoS.

Release client_sk before continuing.

This bug was found with ZeroPath.

AnalysisAI

Remote unauthenticated denial of service in the Linux kernel's ksmbd in-kernel SMB server allows an attacker to exhaust kernel socket resources by repeatedly tripping the per-IP connection limit. When ksmbd_kthread_fn() rejects a connection that exceeds the per-IP limit, it sets ret = -EAGAIN and continues the accept loop without releasing the just-accepted socket, leaking one socket per rejected attempt from a single source IP. This is a resource-leak DoS with no public exploit identified at time of analysis and a low EPSS score (0.16%, 6th percentile).

Technical ContextAI

The flaw resides in ksmbd, the kernel-space SMB3 file server introduced in Linux 5.15 as a higher-performance alternative to user-space Samba. It listens on TCP/445 and spawns a kernel thread (ksmbd_kthread_fn) that accepts inbound connections. ksmbd enforces a per-IP connection cap to limit abuse; when that cap is exceeded the accept loop bails out with -EAGAIN but fails to call the socket-release path (sock_release/ksmbd free of client_sk) on the socket it already accepted. The upstream fix releases client_sk before continuing the loop. The root cause is a missing-resource-release / memory (socket) leak, corresponding to CWE-772 (Missing Release of Resource after Effective Lifetime) / CWE-401, even though the NVD CWE field is unpopulated. Because the leaked object is a kernel socket structure, repeated triggering steadily consumes non-swappable kernel memory and socket handles.

Affected ProductsAI

The affected component is the ksmbd in-kernel SMB server within the mainline and stable Linux kernel trees (present since 5.15). No CPE strings were provided in the input, so exact vulnerable version ranges are not enumerated by NVD here; the fix is distributed across multiple stable branches as evidenced by the five kernel.org stable commits (35521b5a7e8a, 4587a7826be1, 5746b2a0f5eb, 7a3c7154d5fc, 98a5fd31cbf7). Any kernel built with CONFIG_SMB_SERVER (ksmbd) enabled and serving SMB, prior to picking up these backports, should be considered affected. Distribution-specific fixed package versions should be confirmed against each vendor's kernel advisory.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update that backports the fix that releases client_sk before continuing the accept loop, available via the stable commits at https://git.kernel.org/stable/c/35521b5a7e8a184548125f4530552101236dcda1 and its companions (4587a7826be1ae0190dba10ff70b46bb0e3bc7d3, 5746b2a0f5eb3d79667b3c51fe849bd62464220e, 7a3c7154d5fc05956a8ad9e72ecf49e21555bfca, 98a5fd31cbf72d46bf18e50b3ab0ce86d5f319a9). Until distro kernels ship the fix, the most effective compensating control is to avoid exposing ksmbd to untrusted networks: restrict TCP/445 to trusted management or client subnets via host/network firewall (trade-off: legitimate remote SMB clients on other networks lose access), or where ksmbd is not required, disable/unload the ksmbd module and use user-space Samba instead (trade-off: performance and feature differences). Rate-limiting new inbound 445 connections per source IP at an upstream firewall slows resource exhaustion but does not fully close the leak.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68246 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy