CVE-2025-68246: ksmbd: close accepted socket when per-IP limit rejects connection
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: close accepted socket when per-IP limit rejects connection
When the per-IP connection limit is exceeded in ksmbdkthreadfn(), the code sets ret = -EAGAIN and continues the accept loop without closing the just-accepted socket. That leaks one socket per rejected attempt from a single IP and enables a trivial remote DoS.
Release clientsk before continuing.
This bug was found with ZeroPath.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68246?
The severity of CVE-2025-68246 is classified as a moderate security risk due to potential denial of service conditions.
How do I fix CVE-2025-68246?
To fix CVE-2025-68246, ensure that you update to the latest version of the Linux kernel where this vulnerability has been patched.
What impact does CVE-2025-68246 have on system security?
CVE-2025-68246 can lead to denial of service by allowing excessive per-IP connections without properly closing sockets.
Who is affected by CVE-2025-68246?
CVE-2025-68246 affects users of the Linux kernel who utilize the ksmbd SMB server implementation.
What is ksmbd in the context of CVE-2025-68246?
In the context of CVE-2025-68246, ksmbd is the SMB server implemented in the Linux kernel which is vulnerable to connection handling issues.