CVE-2025-68246: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68246 is a socket resource leak vulnerability in the Linux kernel's ksmbd (kernel SMB server) subsystem that enables a trivial remote Denial of Service (DoS). When the per-IP connection limit is exceeded in ksmbd_kthread_fn(), the code sets ret = -EAGAIN and continues the accept loop without closing the just-accepted socket, leaking one socket per rejected connection attempt from a single IP. The vulnerability affects the Linux kernel across multiple stable branches and was disclosed on December 16, 2025. Fixed versions include Linux 6.1.159, 6.6.117, 6.12.59, 6.17.9, and 6.18. No CVSS base score has been formally assigned; the EPSS score is approximately 0.018% (Feedly, EUVD).

The root cause is a missing socket release (resource leak) in the ksmbd connection acceptance loop — classified as CWE-404 (Improper Resource Shutdown or Release). In ksmbd_kthread_fn(), when a new TCP connection is accepted but subsequently rejected because the per-IP connection limit has been reached, the code path sets an error code and continues the loop without calling the appropriate socket close/release function on client_sk. The fix requires releasing client_sk before continuing the loop. The bug was discovered and reported by ZeroPath (Feedly, EUVD).

Successful exploitation causes a socket descriptor leak on the server for every rejected connection attempt from a single IP address, progressively exhausting kernel socket resources. An unauthenticated remote attacker can trigger this condition repeatedly to deplete available file descriptors or kernel memory, resulting in a Denial of Service that disrupts SMB file sharing services and potentially destabilizes the affected host. There is no known confidentiality or integrity impact; the vulnerability is limited to availability (Feedly, EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68246. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. However, the attack is described as "trivial" — requiring only repeated SMB connection attempts from a single IP to a ksmbd-enabled server, with no authentication required (Feedly, EUVD).

1. Reconnaissance: Identify Linux hosts running ksmbd (kernel SMB server) by scanning for open TCP port 445 and confirming SMB service responses using tools like nmap or smbclient.
2. Trigger per-IP connection limit: Rapidly open a large number of TCP connections to port 445 from a single IP address, exceeding the ksmbd per-IP connection limit configured on the target.
3. Sustain connection flood: Continue sending new TCP connection requests in a loop. Each rejected connection leaks one socket on the server side without being properly closed.
4. Resource exhaustion: After sufficient iterations, the server's available socket/file descriptor pool or kernel memory is depleted, causing ksmbd to fail to accept new legitimate connections and potentially destabilizing the host's network stack, achieving a Denial of Service (Feedly, EUVD).

• Network: Unusually high volume of TCP SYN connections to port 445 from a single source IP address; connections that are accepted at the TCP level but do not progress to SMB negotiation.
• Logs: Kernel logs (dmesg or /var/log/kern.log) showing repeated ksmbd per-IP limit rejection messages; system logs indicating file descriptor exhaustion (e.g., "too many open files" errors).
• Process/System: Rapidly increasing open socket count visible via ss -s or cat /proc/net/sockstat; ksmbd worker threads showing elevated socket counts without corresponding active sessions; system resource monitors showing file descriptor usage approaching system limits.

Apply the upstream kernel patches that add client_sk release before the continue statement in ksmbd_kthread_fn(). Fixed versions are available in the following stable kernel releases: 6.1.159, 6.6.117, 6.12.59, 6.17.9, and 6.18. As a workaround, administrators who do not require ksmbd can disable or unload the ksmbd kernel module (modprobe -r ksmbd), or restrict access to TCP port 445 via firewall rules to trusted IP ranges. Debian LTS users should apply the linux-6.1 update referenced in DLA-4436-1 (Feedly, Debian LTS).

The vulnerability was detected by Qualys scanners (multiple detection IDs) and covered by Tenable (Nessus plugin 278879), indicating prompt uptake by vulnerability management vendors. Debian issued a Long Term Support advisory (DLA-4436-1) addressing this and related kernel CVEs. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries (Feedly, Debian LTS, Tenable).