KSMBDrain (CVE-2025-38501): Linux Kernel Flaw Allows Remote DoS Attacks, PoC Available

KSMBDrain (CVE-2025-38501) is a Linux kernel flaw in the KSMBD subsystem that enables remote denial-of-service by exhausting server resources, with a public PoC available. The vulnerability affects Linux kernels since version 5.3, when KSMBD was first merged into mainline, and relies on attackers initiating a TCP three-way handshake but not completing the session, causing the server to hold half-open connections indefinitely.

According to researcher Tianshuo Han, this can allow a remote attacker to exhaust the KSMBD server’s TCP connection limit and block normal client connections. A publicly released PoC on GitHub demonstrates how to exploit the issue by starting a vulnerable KSMBD server, setting the victim IP in poc.py, and running the script to perform repeated TCP handshakes.

The issue has been fixed in the Linux kernel commit e6bb9193974059ddbb0ce7763fa3882bd60d4dc3, which modifies how KSMBD handles incomplete TCP handshakes; administrators are advised to update to the patched kernel version and implement rate-limiting and firewall rules to reduce exposure until updates are applied.