CVE-2025-68246

Vulnerability

In the Linux kernel's ksmbd (SMB server), when the per-IP connection limit is exceeded, the code in ksmbd_kthread_fn() sets ret = -EAGAIN and continues the accept loop without closing the just-accepted socket. This results in a socket leak for every rejected connection attempt from a single IP address.

Exploitation

An unauthenticated remote attacker can repeatedly connect to the ksmbd service from a single IP address. Each connection that would be rejected due to exceeding the per-IP limit will leak a socket, gradually consuming system resources such as file descriptors and memory.

Impact

By sending a high rate of connection attempts, an attacker can exhaust available sockets, leading to a denial-of-service (DoS) condition where further legitimate connections to the SMB server are prevented. This is a trivial remote DoS vulnerability.

Mitigation

The fix is to properly close the accepted socket (client_sk) before continuing the loop when the per-IP limit is exceeded. The patch was applied to the Linux kernel stable branches [1][2]. Users should update to a kernel version containing the fix.