CVE-2025-38501: Linux KSMBD Flaw Lets Unauthenticated Attackers Exhaust SMB Connections
Idle connections can become a service outage for Linux file servers running vulnerable KSMBD code. CVE-2025-38501 allows an unauthenticated remote client to consume connection capacity and block legitimate access. This article explains the flaw, affected kernel branches, available fixes, and practical steps to reduce exposure.
CVE-2025-38501: Linux KSMBD Flaw Lets Unauthenticated Attackers Exhaust SMB Connections
File-sharing availability can be disrupted before a client authenticates to a vulnerable KSMBD server. CVE-2025-38501 allows repeated connections to consume the Linux kernel SMB server's connection capacity, preventing legitimate clients from establishing new connections.
The NVD publication date is August 16, 2025. The upstream correction credits Tianshuo Han as the reporter; he also authored the public technical disclosure dated September 15, 2025. His disclosure records that the issue was reported to the Linux kernel community on August 1, 2025, and documents a publicly available proof of concept.
For defenders, the immediate questions are whether affected KSMBD code is running, who can reach its listener, and whether the deployed kernel includes the correction. Public PoC availability increases the importance of resolving exposed deployments, while confirmed malicious exploitation remains a separate evidence question.
Vulnerability Details
| Attribute | Verified Details |
|---|---|
| CVE identifier | CVE-2025-38501 |
| Affected component | Linux kernel KSMBD server |
| Vulnerability type | Remote denial of service through connection exhaustion |
| Weakness classification | CWE-400: Uncontrolled Resource Consumption |
| CVSS v3.1 severity | 7.5 — High |
| CVSS v3.1 vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Access requirements | A reachable, affected KSMBD listener; no SMB credentials or user interaction required |
| NVD publication | August 16, 2025 |
| Reporter and technical disclosure author | Tianshuo Han |
KSMBD implements an SMB3 file server within the Linux kernel and normally listens on TCP port 445. It accepts client connections and assigns resources to handle them. In the vulnerable behavior, a remote client can complete the TCP handshake and then leave the connection idle without progressing into normal SMB activity.
The technical disclosure describes default behavior that retains these connections indefinitely. Repeated connections from one source can exhaust the configured connection capacity and block legitimate new connections. A timeout can reduce the lifetime of individual idle connections, but repeated connection creation can still cause disruption.
Impact
The established impact is denial of service: users and applications may be unable to initiate access to affected SMB shares. Business consequences depend on the workloads that need those connections and the availability of alternative access paths.
The CVSS vector scores high availability impact and no confidentiality or integrity impact. The documented mechanism does not establish data theft, file modification, or remote code execution. It also does not justify assuming that every existing file transfer will stop.
Applicability depends on the deployed service. An affected KSMBD server must be running and reachable for the documented network attack path to apply. A Linux installation, an SMB client, or an open port 445 alone does not establish exposure. Identify KSMBD separately from other SMB server implementations.
Affected Versions
The official Linux record identifies Linux 5.15 as the introduction point. The following table lists the recorded upstream fix milestones; assess each kernel against its own branch and any applicable backport.
| Upstream Branch | Recorded Fixed Release |
|---|---|
| 6.1 | 6.1.148 |
| 6.6 | 6.6.102 |
| 6.12 | 6.12.42 |
| 6.15 | 6.15.10 |
| 6.16 | 6.16.1 |
| Mainline 6.17 | 6.17; the original Linux CVE announcement identifies inclusion in 6.17-rc1 |
These are historical fix milestones, not a recommendation to deploy an obsolete release. The table is not an exhaustive list of affected release families, and the reviewed upstream record does not specify a fixed 5.15-series release. Omitted branches must not be assumed safe.
Fixes can be backported to older kernel trees. For a distribution kernel, verify the complete package version and the distribution's CVE resolution status; a base version string alone may not establish whether the fix is present. Select a supported, corrected update for the deployment.
Exploit Maturity Assessment
Classification: Public DoS PoC Available. A publicly available proof of concept reproduces the documented connection-exhaustion mechanism. The CVE record also contains a CISA assessment dated September 17, 2025 that classifies exploitation as poc and the behavior as automatable.
This establishes public reproducer availability. It does not establish attacker adoption, a weaponized campaign, or confirmed exploitation in the wild. The reviewed materials do not provide measured success rates or a comprehensive test matrix across kernels and configurations.
PoC Reproducibility
| Assessment Area | Evidence and Limits |
|---|---|
| Prerequisites | A running, vulnerable KSMBD server and network reachability to its listener. SMB authentication and user interaction are not required. |
| Published demonstration | Repeated accepted TCP connections remain idle and occupy connection capacity, preventing legitimate new SMB connections. |
| Reproducibility assessment | The mechanism and a public reproducer are documented. Configuration, connection limits, network controls, and installed corrections affect the result. |
| Reliability limits | No cross-deployment success rate is established. This article is a source-based assessment; the reproducer was not independently executed for this review. |
Vulnerability Timeline and Time-to-Exploit
| Date | Milestone | Evidence Qualification |
|---|---|---|
| Unavailable | Initial discovery | A separate discovery date was not established. |
| August 1, 2025 | Report to the Linux kernel community | Date stated in the technical disclosure. |
| August 8, 2025 | Upstream patch merge reported | Date stated in the disclosure; distinct from availability of a fixed stable release. |
| August 15, 2025 | Fixed stable releases | Release changelogs date Linux 6.1.148, 6.6.102, 6.12.42, 6.15.10, and 6.16.1 to this day. |
| August 16, 2025 | NVD and CVE publication | Official publication records; used as the publication milestone in this analysis. |
| September 15, 2025 | Detailed technical disclosure and documented public PoC availability | The disclosure explicitly points to an available reproducer. Its earliest public release date was not independently established. |
| Unavailable | First confirmed malicious exploitation | No verified exploitation date was established in the reviewed evidence. |
Using these calendar dates, the interval from the reported submission to the listed stable fixes is 14 days. Those stable fixes precede NVD publication by one day. The disclosure documenting public PoC availability follows NVD publication by 30 days.
Time-to-exploit remains unavailable. The 30-day interval measures publication to documented PoC availability, not the time to first malicious use or necessarily the first public release of exploit code. The reporting and merge dates retain their attribution to the disclosure; publication timing follows the official NVD and CVE records.
Active Exploitation and Threat Actors
As of the October 23, 2026 review, no confirmed in-the-wild exploitation, named threat actor, or attributed campaign was established in the examined evidence. Public PoC availability is confirmed, but it does not establish any of those additional claims.
This is a statement about the reviewed evidence, not proof that exploitation has never occurred. There is no verified incident date from which to calculate attacker adoption or a patch-to-exploitation interval.
Indicators of Compromise
No campaign-specific IOCs are documented in the reviewed material. No confirmed malicious IP addresses, domains, file hashes, or payload identifiers are presented for this CVE. A source producing unusual connection activity is an investigative lead; the behavior alone does not establish that it is malicious.
Connection accumulation, limited SMB activity, and legitimate connection failures should be treated as behavioral detection indicators and correlated with the deployment's normal workload.
Detection and Monitoring
| Monitoring Source | Useful Observations | Interpretation |
|---|---|---|
| Network connection telemetry | Growth in simultaneous established connections, long connection lifetimes, and concentration from one source. | Correlate with protocol-aware telemetry where available to assess whether connections progress into normal SMB activity. |
| Firewall and network flow logs | Repeated permitted connections to the actual KSMBD listener, normally TCP port 445, and changes in traffic patterns. | Available fields vary; firewall logs alone may not reveal SMB negotiation or application progress. |
| KSMBD and kernel logs | Relevant connection-handling or resource-related messages, where emitted and collected. | Log detail depends on the kernel and logging configuration. No universal CVE-specific event ID or log signature is established. |
| Service health and client telemetry | Failures establishing new SMB connections during abnormal connection accumulation. | Investigate competing explanations such as normal demand, configuration errors, or other service faults. |
These monitoring recommendations are analytical guidance. Official KSMBD documentation describes configurable diagnostic components, including connection-related debugging; it does not guarantee that every idle connection produces a default log entry.
MITRE ATT&CK and TTP Assessment
The documented behavior supports a potential mapping to Impact (TA0040) and Service Exhaustion Flood (T1499.002), a sub-technique of Endpoint Denial of Service (T1499). This is SecPod's analytical mapping of service-resource exhaustion, not an observed campaign attribution.
| Tactic | Technique | ID |
|---|---|---|
| Initial Access | Not established | Not established |
| Execution | Not established | Not established |
| Persistence | Not established | Not established |
| Privilege Escalation | Not established | Not established |
| Defense Evasion | Not established | Not established |
| Lateral Movement | Not established | Not established |
| Command and Control | Not established | Not established |
| Impact | Service Exhaustion Flood — potential analytical mapping | T1499.002 |
Network reachability does not demonstrate an Initial Access technique or an attacker foothold. Unsupported tactics are therefore left unassigned.
Post-Exploitation and Vulnerability Chaining
Persistence, privilege escalation, lateral movement, data exfiltration, and vulnerability chaining have not been demonstrated for this CVE in the reviewed evidence. The documented denial of service does not itself provide a demonstrated code-execution or access primitive. These evidence limits should not be converted into claims that future chains are impossible.
Risk Assessment
The following is a qualitative SecPod assessment. It supplements the CVSS severity with deployment context and does not assign an unsupported probability of exploitation.
| Risk Factor | Assessment |
|---|---|
| Likelihood | Exposure is elevated when an unpatched KSMBD service is reachable by untrusted clients: the documented path requires no authentication or user interaction and has low assessed attack complexity. |
| Exploit maturity influence | A public DoS PoC reduces the effort needed to reproduce the documented behavior. It does not prove active attacker adoption. |
| Operational impact | High availability impact is especially consequential where essential workflows depend on new SMB connections to the affected server. |
| Overall priority | High remediation priority for reachable, unpatched KSMBD supporting important services. Restrict exposure while arranging the supported kernel update. |
| Applicability boundary | A system with the correction, or without a running affected KSMBD service, does not meet the same vulnerable-deployment conditions. Reassess using the actual kernel package and configuration. |
Mitigation and Remediation
The upstream correction, commit e6bb9193974059ddbb0ce7763fa3882bd60d4dc3, adds peer-address tracking and a check limiting repeated connections from the same IP address in KSMBD's TCP acceptance path.
- Install a supported kernel update containing the fix. Confirm CVE-2025-38501 resolution for the exact distribution package, complete the required activation or reboot, and verify that the corrected kernel is running.
- Limit access to required clients and networks. Restrict the actual KSMBD listener and remove unnecessary exposure to untrusted sources.
- Disable KSMBD where it is unnecessary. Use supported service or configuration controls after checking dependencies.
- Validate service health after remediation. Check legitimate client access and review connection behavior against the normal baseline.
Network restrictions reduce exposure while patching is arranged, and monitoring can help identify service disruption. Timeout changes should be evaluated against documented configuration options and client needs; they are not equivalent to applying the correction. Follow the kernel project's guidance to use tested kernel updates instead of treating an isolated commit as a complete maintenance strategy.
Sources and Verification: Publication, severity, and version information were checked against nvd.nist.gov/vuln/detail/CVE-2025-38501, cve.org/CVERecord?id=CVE-2025-38501, and the official Linux CVE announcement archived at lore.kernel.org/linux-cve-announce/2025081612-CVE-2025-38501-e51f@gregkh/. The maintained Linux advisory is in git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-38501.mbox.
Patch evidence is recorded at git.kernel.org/stable/c/e6bb9193974059ddbb0ce7763fa3882bd60d4dc3. Release dates were checked in the official files ChangeLog-6.1.148, ChangeLog-6.6.102, ChangeLog-6.12.42, ChangeLog-6.15.10, and ChangeLog-6.16.1 under cdn.kernel.org/pub/linux/kernel/v6.x/.
The reporting timeline, mechanism, and public reproducer are documented in Tianshuo Han's September 15, 2025 technical disclosure, [CVE-2025-38501] Linux kernel: KSMBD service DoS by TCP handshake, referenced by the CVE record. KSMBD behavior and diagnostics are described at docs.kernel.org/filesystems/smb/ksmbd.html; update and backport guidance appears at docs.kernel.org/process/cve.html and docs.kernel.org/process/stable-kernel-rules.html. The ATT&CK reference is attack.mitre.org/techniques/T1499/002/.
Sources were reviewed on October 23, 2026. Timing calculations, risk prioritization, detection recommendations, and ATT&CK mapping are SecPod analysis. Public PoC availability is distinguished from confirmed malicious exploitation; unverified dates and behaviors are not treated as established facts.
Constantly Fix Risks with Saner Patch Management
Saner Patch Management helps organizations identify missing patches, prioritize remediation, and automate security updates across Windows, Linux, macOS, and more than 550 third-party applications.
Policy-based deployment, patch compliance tracking, and rollback capabilities help teams manage updates across enterprise environments. Combining patch information with asset exposure and business context supports more informed remediation priorities.
See how Saner Patch Management can support your organization's patching workflow. Schedule a demo.
