CVE-2025-38501: Linux Kernel ksmbd DoS Vulnerability

CVE-2025-38501 Overview

CVE-2025-38501 is a resource exhaustion vulnerability in the Linux kernel's ksmbd in-kernel SMB server. Repeated TCP connections originating from the same client IP address can consume all available server-side connection slots. Once the maximum connection limit is reached, legitimate clients are unable to establish new SMB sessions. The upstream fix limits the number of concurrent connections a single source IP can hold open. The issue is tracked under CWE-400: Uncontrolled Resource Consumption and affects Linux kernel builds that enable ksmbd, as well as Debian GNU/Linux 11 packages that ship the affected kernel.

Critical Impact
An unauthenticated remote attacker can render an exposed ksmbd service unavailable to legitimate clients by opening repeated connections from a single IP.

Affected Products

Linux kernel builds with ksmbd (CONFIG_SMB_SERVER) enabled
Debian GNU/Linux 11 (Bullseye) kernel packages
Downstream distributions shipping vulnerable stable kernel branches

Discovery Timeline

2025-08-16 - CVE-2025-38501 published to the National Vulnerability Database (NVD)
2025-09-15 - Public discussion posted on the OpenWall OSS-Security list
2025-10 - Debian LTS advisory released for affected kernel packages
2026-06-17 - Last modified in NVD database

Technical Details for CVE-2025-38501

Vulnerability Analysis

The ksmbd module implements an SMB3 file server directly inside the Linux kernel. It accepts TCP connections on port 445 and hands each session to a worker that services SMB requests. The server enforces a global cap on the number of simultaneously connected clients, but prior to this fix it did not enforce any per-source-IP quota. A remote peer able to reach the SMB port can therefore establish connections in a loop until the global cap is saturated, leaving no capacity for other clients. The condition persists until the attacker stops connecting or the operator restarts the service.

A public proof-of-concept exercising this behavior is available in the KSMBDrain repository. Impact is limited to availability of the SMB service; confidentiality and integrity are not affected.

Root Cause

The root cause is missing accounting of active connections on a per-client-address basis. ksmbd tracked only the aggregate session count against the server-wide maximum. The kernel patches introduce a counter keyed by source IP so that new connections from an address already holding many sessions are refused before consuming a global slot. The fix landed across multiple stable branches in commits 6073afe6, 7e5d91d3, cb092fc3, e6bb9193, f1ce9258, and fa1c47af.

Attack Vector

Exploitation requires only network reachability to the ksmbd TCP listener, typically port 445. No authentication or user interaction is needed. An attacker script opens SMB TCP sessions in a tight loop from a single source address and keeps them open. Once the server's maximum connection count is reached, subsequent connect() attempts from unrelated clients are refused or time out. Because the attack runs over standard SMB transport, it is indistinguishable at the TCP layer from a burst of legitimate clients originating behind a shared NAT gateway.

The vulnerability manifests in the connection acceptance path of ksmbd. See the OSS-Security discussion and the upstream commits above for details.

Detection Methods for CVE-2025-38501

Indicators of Compromise

Sudden growth in the number of ksmbd worker threads or established TCP sessions on port 445 originating from a single remote address
SMB clients reporting connection refused or timeout errors while the host itself remains reachable on other ports
Repeated short-lived or long-held SMB TCP connections from the same source IP in netstat, ss, or firewall flow logs

Detection Strategies

Baseline the normal count of concurrent SMB sessions per source address and alert when a single peer exceeds that baseline
Correlate SMB service errors on client machines with connection counters on the server to distinguish DoS from misconfiguration
Ingest ksmbd kernel log messages and firewall connection state tables into a central SIEM to identify sustained connection floods

Monitoring Recommendations

Monitor ss -tn state established '( dport = :445 or sport = :445 )' output for source-IP concentration
Track conntrack table entries for port 445 and alert on rapid growth from any single address
Enable ksmbd debug logging during triage to record connection setup and teardown events

How to Mitigate CVE-2025-38501

Immediate Actions Required

Update to a Linux kernel that includes one of the fix commits listed above, or apply the vendor kernel package that references CVE-2025-38501
Restrict inbound access to TCP port 445 to trusted network ranges using host or perimeter firewalls
Disable ksmbd on hosts that do not require an in-kernel SMB server and use an alternative such as Samba smbd if appropriate

Patch Information

The upstream fix, ksmbd: limit repeated connections from clients with the same IP, has been backported to multiple stable kernel branches. Refer to the kernel.org commits 6073afe6, 7e5d91d3, cb092fc3, e6bb9193, f1ce9258, and fa1c47af. Debian users should follow the Debian LTS announcement for package versions.

Workarounds

Rate-limit new TCP connections to port 445 per source IP using nftables or iptablesconnlimit rules
Terminate SMB access behind a VPN or bastion so untrusted clients cannot reach ksmbd directly
Unload the ksmbd module (modprobe -r ksmbd) on systems where SMB serving is not required

bash

# Example: limit concurrent TCP/445 connections per source IP to 16 using nftables
nft add table inet ksmbd_guard
nft add chain inet ksmbd_guard input '{ type filter hook input priority 0; }'
nft add rule inet ksmbd_guard input tcp dport 445 ct state new \
    meter smb_conns { ip saddr limit rate over 16/second } drop

# Alternative: iptables connlimit for total established connections per source
iptables -A INPUT -p tcp --dport 445 -m connlimit \
    --connlimit-above 16 --connlimit-mask 32 -j REJECT --reject-with tcp-reset