Linux Kernel KSMBD Flaw Lets Remote Attackers Drain Server Resources

A critical vulnerability in the Linux kernel’s KSMBD implementation has been revealed, allowing remote attackers to exhaust server connection resources through a simple denial-of-service attack. The flaw, tracked as CVE-2025-38501 and dubbed “KSMBDrain,” can render SMB services unavailable by consuming all available connections.

According to Github, the attack works by targeting KSMBD’s connection handling: remote attackers can establish TCP connections to the KSMBD server and then stop responding to subsequent packets, effectively leaving abandoned connections open. The issue affects Linux kernel versions 5.3+ (since KSMBD merged into the mainline), and the server can sustain resource exhaustion even when a one-minute timeout is configured, as attackers can time repeated connection exhaustion from a single IP.

Linux kernel developers addressed the problem in commit e6bb9193974059ddbb0ce7763fa3882bd60d4dc3, implementing proper connection management to prevent the exhaustion. Administrators should update to patched kernels and review SMB service configurations to enforce appropriate connection limits and timeouts.