CVE-2025-38501

CVE-2025-38501 is a denial-of-service vulnerability in the Linux kernel's KSMBD (SMB Direct) implementation. It stems from the way KSMBD handles half-open TCP connections. An unauthenticated, remote attacker can exploit this by initiating numerous TCP connections to the KSMBD server but then failing to complete the handshake. The server continues to hold these incomplete connections, which exhausts the maximum connection limit and prevents legitimate SMB traffic. This vulnerability, dubbed "KSMBDrain," affects Linux kernel versions 5.3 onward. A proof-of-concept exploit demonstrates how an attacker can flood a server with SYN packets, causing the server to indefinitely hold sockets open. By repeatedly sending SYN packets, the attacker saturates the server's connection limit, effectively halting file transfers and authentication services. A patch has been implemented to limit repeated connections from the same IP address.