CVE-2025-68246 ksmbd: close accepted socket when per-IP limit rejects connection
Remote attackers can cause denial of service in the Linux kernel ksmbd module by exhausting sockets through repeated connection attempts exceeding per-IP limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68246?
CVE-2025-68246 is a high-severity denial of service vulnerability in Linux, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: close accepted socket when per-IP limit rejects connection
When the per-IP connection limit is exceeded in ksmbd_kthread_fn(), the code sets ret = -EAGAIN and continues the accept loop without closing the just-accepted socket. That leaks one socket per rejected attempt from a single IP and enables a trivial remote DoS.
Release client_sk before continuing.
This bug was found with ZeroPath.
Which versions are affected by CVE-2025-68246?
How do I fix CVE-2025-68246?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-68246 being exploited?
There is no known exploitation of CVE-2025-68246 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68246, DEBIAN-CVE-2025-68246, GHSA-782g-7r6x-6926, ROOT-OS-DEBIAN-12-CVE-2025-68246, ROOT-OS-DEBIAN-13-CVE-2025-68246, ROOT-OS-UBUNTU-2204-CVE-2025-68246 and 2 more.