A newly disclosed vulnerability in the Linux kernel’s kernel-space SMB server (KSMBD) subsystem enables remote attackers to exhaust server resources by leveraging incomplete TCP connections.
Tracked as CVE-2025-38501, this flaw affects all KSMBD deployments introduced in Linux kernel 5.3 and persists until patched by commit e6bb9193974059ddbb0ce7763fa3882bd60d4dc3.
A proof-of-concept exploit, KSMBDrain, demonstrates how an adversary can trigger a denial-of-service condition by repeatedly initiating three-way handshakes and then failing to respond to subsequent packets.
This forces the server to maintain half-open connections indefinitely, quickly consuming the maximum connection limit and preventing legitimate clients from accessing SMB shares.
Under default settings, KSMBD holds each accepted TCP connection without an enforced timeout, awaiting remaining handshake or data exchange packets.
An attacker from a single IP address can sequentially open thousands of half-open connections, monopolizing available slots.
Although administrators can configure a user-space timeout with a minimum of one minute, most distributions ship default configurations without aggressive timeouts.
The PoC script exploits this behavior by first establishing the three-way handshake and then ceasing communication, causing the server to continue reserving resources.
This trivial requirement renders exploitation straightforward and automated, posing a serious risk to file-sharing services on Linux servers
Affected Version
KSMBD was merged into the mainline Linux kernel in version 5.3. All subsequent releases up to the patched commit e6bb9193974059ddbb0ce7763fa3882bd60d4dc3 are vulnerable.
Systems running unpatched kernels in production environments, particularly those relying on default KSMBD configuration files, remain at risk of resource exhaustion and service disruption.
Usage
Successful exploitation requires only network access to the KSMBD server’s SMB port (typically TCP port 445 or 139).
The attacker must:
- Launch the KSMBDrain PoC against the target IP by modifying the
poc.pyscript with the victim’s address. - Execute the script, which initiates repeated TCP handshakes and then stops responding.
No authentication credentials or specialized privileges are needed, making the attack feasible from any remote host that can reach the SMB service.
Risk Factor Table
| Risk Factor | Description | Severity | Likelihood |
|---|---|---|---|
| Connection Exhaustion | Half-open TCP connections are held indefinitely, consuming server resources until capacity is reached. | High | High |
| Denial of Service | Legitimate clients are unable to connect or transfer files, resulting in service unavailability. | Critical | Medium |
| Configuration Hardening Gap | Default KSMBD settings lack aggressive timeout controls, allowing extended resource hogging by an attacker. | Medium | High |
The KSMBDrain PoC was developed and refined in collaboration with @FFreestanding, who assisted in reproducing the bug and fine-tuning the exploit logic.
This proof-of-concept code is provided strictly for educational and research purposes. Use responsibly and only on systems under explicit permission.
The authors and contributors disclaim any liability for misuse or damage resulting from this code.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=A proof-of-concept exploit, KSMBDrain, demonstrates how an adversary can trigger a denial-of-service condition by repeatedly initiating three-way handshakes and then failing to respond to subsequent packets.){kind=link}