CVE-2025-68246

What it actually does

Failure to close an accepted socket when the per-IP connection limit is exceeded in ksmbd_kthread_fn causes a socket descriptor leak on every rejected connection attempt from a single source IP, exhausting kernel resources until the system can no longer accept new connections.

Why it matters to the business

Kernel SMB servers become unreachable after repeated connection attempts from one IP, causing service disruption, potential data-access loss for users and applications, and requiring system restarts that affect availability across Linux-based file-sharing deployments.

How an attack unfolds

An attacker repeatedly initiates TCP connections to the ksmbd listener from the same source IP address; each attempt that exceeds the per-IP limit triggers the buggy path that leaks the socket without closing it, gradually exhausting available sockets until new legitimate connections are refused.

How to fix it

Upgrade the Linux kernel to a version containing commit 7a3c7154d5fc05956a8ad9e72ecf49e21555bfca or later; for tez packages on Chainguard and Wolfi apply version 0.10.4-r6 or newer. Where immediate patching is not possible, restrict inbound SMB access via firewall rules to trusted source IPs or disable ksmbd if SMB services are not required.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or package version; attempt to reproduce the original connection-rejection scenario while monitoring socket counts with ss or netstat to verify sockets are properly closed; review kernel build logs or package manifests for the fix identifier.

Typical attack path

1. Locate a host running ksmbd with SMB ports exposed
2. Establish multiple concurrent TCP connections from a single source IP to the target listener
3. Trigger the per-IP limit check inside ksmbd_kthread_fn on each new accept
4. Observe continued acceptance-loop behavior without socket closure, accumulating leaked descriptors
5. Repeat until kernel socket tables are exhausted and new connections are denied

How to detect it

Review kernel logs and SMB connection logs for repeated accept/reject sequences from the same source IP without corresponding socket-close events; correlate with system resource metrics showing rising socket counts or file-descriptor exhaustion.

What your security team should do

• Prioritize kernel upgrades on all systems exposing ksmbd to the network
• Apply network-level controls to limit SMB exposure until patches are deployed
• Monitor for unusually high connection rates from single IPs as a temporary compensating control
• Include the fixed commit hash in patch-management and vulnerability-scanning policies