Executive brief
A vulnerability exists in the Linux kernel's ksmbd component, which provides file-sharing services over a network. When the system reaches its limit for connections from a single user, it fails to properly close new connection attempts, leading to a resource leak. An attacker can exploit this to exhaust system resources, potentially causing the server to crash or become unresponsive to legitimate users.
Technical details
A resource leak vulnerability exists in the ksmbd_kthread_fn() function within fs/smb/server/transport_tcp.c of the Linux kernel. When a per-IP connection limit is reached, the code returns -EAGAIN and continues the accept loop without calling sock_release() on the newly accepted socket. This results in a socket leak for every rejected connection attempt from a single IP address. A remote, unauthenticated attacker can exploit this to exhaust the system's file descriptors or memory, leading to a denial-of-service condition. The issue has been resolved in various stable branches including 6.1.159, 6.6.117, 6.12.59, and 6.17.9.
Affected products
- Linux Linux Kernel 5.15 to 6.17.9
Timeline
- 2025-11-24: patched: Fixes committed to stable branches.
- 2025-12-16: disclosed: CVE published.
References
- https://git.kernel.org/stable/c/35521b5a7e8a184548125f4530552101236dcda1
- https://git.kernel.org/stable/c/4587a7826be1ae0190dba10ff70b46bb0e3bc7d3
- https://git.kernel.org/stable/c/5746b2a0f5eb3d79667b3c51fe849bd62464220e
- https://git.kernel.org/stable/c/7a3c7154d5fc05956a8ad9e72ecf49e21555bfca
- https://git.kernel.org/stable/c/98a5fd31cbf72d46bf18e50b3ab0ce86d5f319a9