{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38501", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.022Z", "datePublished": "2025-08-16T05:30:09.138Z", "dateUpdated": "2026-08-05T12:02:28.419Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:28.419Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: limit repeated connections from clients with the same IP\n\nRepeated connections from clients with the same IP address may exhaust\nthe max connections and prevent other normal client connections.\nThis patch limit repeated connections from clients with the same IP." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP port 445, and the vulnerable accept path in `ksmbd_kthread_fn()` is driven entirely by inbound TCP connections from arbitrary remote hosts. Internet- and LAN-exposed file servers reach this code with no intermediate hop.\nAC:L - The attacker simply opens TCP connections in a loop and sends nothing; no race, no memory-layout dependency, and no state outside the attacker's control is involved. Because `ksmbd_tcp_readv()` is called with `max_retries = -1` and deadtime defaults to 0, the held connections are never reaped, making the attack fully deterministic and persistent.\nPR:N - Connection slots and per-connection kernel threads are allocated in `ksmbd_tcp_new_connection()` immediately after `kernel_accept()`, long before SMB NEGOTIATE or SESSION_SETUP — no credentials, share access, or SMB dialect negotiation is required. A completed TCP handshake is sufficient.\nUI:N - The attack is driven entirely by the remote attacker's own connections against the listening server socket. No action by an administrator, user, or legitimate SMB client is needed.\nS:U - The resource exhaustion is confined to the kernel's own connection slots, kthreads, and memory, all within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The fix adds only per-IP connection accounting; there is no out-of-bounds read, uninitialized memory disclosure, or kernel pointer leak anywhere on the traced path. Nothing about the attacker's data is returned or exposed.\nI:N - No memory is corrupted and no data is modified — the flaw is missing admission control, not a write primitive. Server state and file data remain intact.\nA:H - A single unauthenticated remote host can consume all of `server_conf.max_connections` with silent, never-timing-out connections, completely denying SMB service to every other client; where `max_connections` is unset the pre-fix code has no cap at all, allowing unbounded kthread and kernel-memory allocation plus continuous busy-poll CPU burn, escalating to system-wide exhaustion." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/connection.h", "fs/smb/server/transport_tcp.c" ], "versions": [ { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "cb092fc3a62972a4aa47c9fe356c2c6a01cd840b", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "fa1c47af4ff641cf9197ecdb1f8240cbb30389c1", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "7e5d91d3e6c62a9755b36f29c35288f06c3cd86b", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "f1ce9258bcbce2491f9f71f7882b6eed0b33ec65", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "6073afe64510c302b7a0683a01e32c012eff715d", "status": "affected", "versionType": "git" }, { "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "e6bb9193974059ddbb0ce7763fa3882bd60d4dc3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/connection.h", "fs/smb/server/transport_tcp.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.148", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.102", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.42", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.10", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.1", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.102" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.15.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.16.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/cb092fc3a62972a4aa47c9fe356c2c6a01cd840b" }, { "url": "https://git.kernel.org/stable/c/fa1c47af4ff641cf9197ecdb1f8240cbb30389c1" }, { "url": "https://git.kernel.org/stable/c/7e5d91d3e6c62a9755b36f29c35288f06c3cd86b" }, { "url": "https://git.kernel.org/stable/c/f1ce9258bcbce2491f9f71f7882b6eed0b33ec65" }, { "url": "https://git.kernel.org/stable/c/6073afe64510c302b7a0683a01e32c012eff715d" }, { "url": "https://git.kernel.org/stable/c/e6bb9193974059ddbb0ce7763fa3882bd60d4dc3" } ], "title": "ksmbd: limit repeated connections from clients with the same IP", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://github.com/keymaker-arch/KSMBDrain" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "http://www.openwall.com/lists/oss-security/2025/09/15/2" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:10:11.398Z" } }, { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2025-09-17T18:02:57.780485Z", "id": "CVE-2025-38501", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:34:03.682Z" } } ] } }