CVE-2025-38501 (GCVE-0-2025-38501)
Vulnerability from cvelistv5
Published
2025-08-16 05:30
Modified
2026-08-05 12:02
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client connections. This patch limit repeated connections from clients with the same IP.
References
Impacted products
Vendor Product Version
Linux Linux Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
Version: 0626e6641f6b467447c81dd7678a69c66f7746cf
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:10:11.398Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/keymaker-arch/KSMBDrain"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/15/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-38501",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-17T18:02:57.780485Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-30T14:34:03.682Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.h",
            "fs/smb/server/transport_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cb092fc3a62972a4aa47c9fe356c2c6a01cd840b",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "fa1c47af4ff641cf9197ecdb1f8240cbb30389c1",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "7e5d91d3e6c62a9755b36f29c35288f06c3cd86b",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "f1ce9258bcbce2491f9f71f7882b6eed0b33ec65",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "6073afe64510c302b7a0683a01e32c012eff715d",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "e6bb9193974059ddbb0ce7763fa3882bd60d4dc3",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.h",
            "fs/smb/server/transport_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: limit repeated connections from clients with the same IP\n\nRepeated connections from clients with the same IP address may exhaust\nthe max connections and prevent other normal client connections.\nThis patch limit repeated connections from clients with the same IP."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP port 445, and the vulnerable accept path in `ksmbd_kthread_fn()` is driven entirely by inbound TCP connections from arbitrary remote hosts. Internet- and LAN-exposed file servers reach this code with no intermediate hop.\nAC:L - The attacker simply opens TCP connections in a loop and sends nothing; no race, no memory-layout dependency, and no state outside the attacker\u0027s control is involved. Because `ksmbd_tcp_readv()` is called with `max_retries = -1` and deadtime defaults to 0, the held connections are never reaped, making the attack fully deterministic and persistent.\nPR:N - Connection slots and per-connection kernel threads are allocated in `ksmbd_tcp_new_connection()` immediately after `kernel_accept()`, long before SMB NEGOTIATE or SESSION_SETUP \u2014 no credentials, share access, or SMB dialect negotiation is required. A completed TCP handshake is sufficient.\nUI:N - The attack is driven entirely by the remote attacker\u0027s own connections against the listening server socket. No action by an administrator, user, or legitimate SMB client is needed.\nS:U - The resource exhaustion is confined to the kernel\u0027s own connection slots, kthreads, and memory, all within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The fix adds only per-IP connection accounting; there is no out-of-bounds read, uninitialized memory disclosure, or kernel pointer leak anywhere on the traced path. Nothing about the attacker\u0027s data is returned or exposed.\nI:N - No memory is corrupted and no data is modified \u2014 the flaw is missing admission control, not a write primitive. Server state and file data remain intact.\nA:H - A single unauthenticated remote host can consume all of `server_conf.max_connections` with silent, never-timing-out connections, completely denying SMB service to every other client; where `max_connections` is unset the pre-fix code has no cap at all, allowing unbounded kthread and kernel-memory allocation plus continuous busy-poll CPU burn, escalating to system-wide exhaustion."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:28.419Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cb092fc3a62972a4aa47c9fe356c2c6a01cd840b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa1c47af4ff641cf9197ecdb1f8240cbb30389c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e5d91d3e6c62a9755b36f29c35288f06c3cd86b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1ce9258bcbce2491f9f71f7882b6eed0b33ec65"
        },
        {
          "url": "https://git.kernel.org/stable/c/6073afe64510c302b7a0683a01e32c012eff715d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6bb9193974059ddbb0ce7763fa3882bd60d4dc3"
        }
      ],
      "title": "ksmbd: limit repeated connections from clients with the same IP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38501",
    "datePublished": "2025-08-16T05:30:09.138Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:28.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/keymaker-arch/KSMBDrain\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/09/15/2\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T21:10:11.398Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38501\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-17T18:02:57.780485Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400 Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-17T18:00:07.999Z\"}}], \"cna\": {\"title\": \"ksmbd: limit repeated connections from clients with the same IP\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - ksmbd is the in-kernel SMB server listening on TCP port 445, and the vulnerable accept path in `ksmbd_kthread_fn()` is driven entirely by inbound TCP connections from arbitrary remote hosts. Internet- and LAN-exposed file servers reach this code with no intermediate hop.\\nAC:L - The attacker simply opens TCP connections in a loop and sends nothing; no race, no memory-layout dependency, and no state outside the attacker\u0027s control is involved. Because `ksmbd_tcp_readv()` is called with `max_retries = -1` and deadtime defaults to 0, the held connections are never reaped, making the attack fully deterministic and persistent.\\nPR:N - Connection slots and per-connection kernel threads are allocated in `ksmbd_tcp_new_connection()` immediately after `kernel_accept()`, long before SMB NEGOTIATE or SESSION_SETUP \\u2014 no credentials, share access, or SMB dialect negotiation is required. A completed TCP handshake is sufficient.\\nUI:N - The attack is driven entirely by the remote attacker\u0027s own connections against the listening server socket. No action by an administrator, user, or legitimate SMB client is needed.\\nS:U - The resource exhaustion is confined to the kernel\u0027s own connection slots, kthreads, and memory, all within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:N - The fix adds only per-IP connection accounting; there is no out-of-bounds read, uninitialized memory disclosure, or kernel pointer leak anywhere on the traced path. Nothing about the attacker\u0027s data is returned or exposed.\\nI:N - No memory is corrupted and no data is modified \\u2014 the flaw is missing admission control, not a write primitive. Server state and file data remain intact.\\nA:H - A single unauthenticated remote host can consume all of `server_conf.max_connections` with silent, never-timing-out connections, completely denying SMB service to every other client; where `max_connections` is unset the pre-fix code has no cap at all, allowing unbounded kthread and kernel-memory allocation plus continuous busy-poll CPU burn, escalating to system-wide exhaustion.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"cb092fc3a62972a4aa47c9fe356c2c6a01cd840b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"fa1c47af4ff641cf9197ecdb1f8240cbb30389c1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"7e5d91d3e6c62a9755b36f29c35288f06c3cd86b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"f1ce9258bcbce2491f9f71f7882b6eed0b33ec65\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"6073afe64510c302b7a0683a01e32c012eff715d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0626e6641f6b467447c81dd7678a69c66f7746cf\", \"lessThan\": \"e6bb9193974059ddbb0ce7763fa3882bd60d4dc3\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/smb/server/connection.h\", \"fs/smb/server/transport_tcp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.148\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.102\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.42\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/server/connection.h\", \"fs/smb/server/transport_tcp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/cb092fc3a62972a4aa47c9fe356c2c6a01cd840b\"}, {\"url\": \"https://git.kernel.org/stable/c/fa1c47af4ff641cf9197ecdb1f8240cbb30389c1\"}, {\"url\": \"https://git.kernel.org/stable/c/7e5d91d3e6c62a9755b36f29c35288f06c3cd86b\"}, {\"url\": \"https://git.kernel.org/stable/c/f1ce9258bcbce2491f9f71f7882b6eed0b33ec65\"}, {\"url\": \"https://git.kernel.org/stable/c/6073afe64510c302b7a0683a01e32c012eff715d\"}, {\"url\": \"https://git.kernel.org/stable/c/e6bb9193974059ddbb0ce7763fa3882bd60d4dc3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: limit repeated connections from clients with the same IP\\n\\nRepeated connections from clients with the same IP address may exhaust\\nthe max connections and prevent other normal client connections.\\nThis patch limit repeated connections from clients with the same IP.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.148\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.102\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.42\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15.10\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.1\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:02:28.419Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-38501\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:02:28.419Z\", \"dateReserved\": \"2025-04-16T04:51:24.022Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-08-16T05:30:09.138Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.