Security readout for executives and security teams
Plain-English summary
A remote attacker can repeatedly trigger rejected SMB connections and cause Linux’s ksmbd server to retain sockets instead of releasing them. Continued resource consumption can make the service or system unavailable. The issue affects availability only; the supplied evidence does not indicate data theft or modification.
Executive priority
Prioritize exposed ksmbd servers because unauthenticated remote traffic can impair availability. Patch or isolate internet-reachable systems promptly, then address internally reachable servers according to service criticality. Emergency response is warranted if resource exhaustion or abnormal SMB connection bursts are observed.
Technical view
When ksmbd’s per-IP connection limit is exceeded, ksmbd_kthread_fn() returns to its accept loop with -EAGAIN without releasing the newly accepted client socket. Each rejected attempt therefore leaks a socket. The resolved code releases client_sk before continuing. CVSS 3.1 is 7.5: network-accessible, low complexity, unauthenticated, no user interaction, and high availability impact.
Likely exposure
Exposure is most likely on affected Linux systems where ksmbd is enabled and reachable over a network. Systems not running ksmbd are not implicated by the supplied description. The bundled version data is unusual and insufficient to determine every distribution package’s fixed status; confirm against kernel or distribution advisories.
Exploitation context
The condition is remotely triggerable without privileges or user interaction and is described as enabling a trivial denial of service. However, the bundle marks the CVE as absent from KEV and provides no evidence of active exploitation, public exploit availability, or observed attacks.
Researcher notes
The vulnerable control path combines per-IP limit rejection, ret = -EAGAIN, and continuation of the accept loop without closing client_sk. Impact is cumulative socket leakage and denial of service. The supplied sources identify multiple stable-kernel commits, but do not provide distribution-specific package mappings or evidence of exploitation in the wild.
Mitigation direction
- Update to a vendor-supported kernel containing the referenced ksmbd socket-release fix.
- Check Linux distribution advisories for the exact corrected package version.
- Disable ksmbd where SMB server functionality is unnecessary.
- Restrict network access to ksmbd until remediation is confirmed.
- Monitor socket and resource exhaustion indicators on exposed systems.
Validation and detection
- Inventory Linux hosts and identify whether ksmbd is enabled or loaded.
- Determine whether ksmbd is reachable from untrusted networks.
- Map installed kernel packages to vendor advisories or referenced stable commits.
- Confirm the corrected code releases client_sk on the per-IP rejection path.
- Review monitoring data for connection bursts, retained sockets, or resource exhaustion.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68246 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7a3c7154d5fc05956a8ad9e72ecf49e21555bfcaCVE reference, Linux
- https://git.kernel.org/stable/c/5746b2a0f5eb3d79667b3c51fe849bd62464220eCVE reference, Linux
- https://git.kernel.org/stable/c/4587a7826be1ae0190dba10ff70b46bb0e3bc7d3CVE reference, Linux
- https://git.kernel.org/stable/c/35521b5a7e8a184548125f4530552101236dcda1CVE reference, Linux
- https://git.kernel.org/stable/c/98a5fd31cbf72d46bf18e50b3ab0ce86d5f319a9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.