linux-cve-announce - CVE-2025-38501: ksmbd: limit repeated connections from clients with the same IP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025081612-CVE-2025-38501-e51f@gregkh>
Date: Sat, 16 Aug 2025 07:30:13 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38501: ksmbd: limit repeated connections from clients with the same IP

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: limit repeated connections from clients with the same IP

Repeated connections from clients with the same IP address may exhaust
the max connections and prevent other normal client connections.
This patch limit repeated connections from clients with the same IP.

The Linux kernel CVE team has assigned CVE-2025-38501 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.1.148 with commit cb092fc3a62972a4aa47c9fe356c2c6a01cd840b
	Fixed in 6.6.102 with commit fa1c47af4ff641cf9197ecdb1f8240cbb30389c1
	Fixed in 6.12.42 with commit 7e5d91d3e6c62a9755b36f29c35288f06c3cd86b
	Fixed in 6.15.10 with commit f1ce9258bcbce2491f9f71f7882b6eed0b33ec65
	Fixed in 6.16.1 with commit 6073afe64510c302b7a0683a01e32c012eff715d
	Fixed in 6.17-rc1 with commit e6bb9193974059ddbb0ce7763fa3882bd60d4dc3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38501
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/server/connection.h
	fs/smb/server/transport_tcp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/cb092fc3a62972a4aa47c9fe356c2c6a01cd840b
	https://git.kernel.org/stable/c/fa1c47af4ff641cf9197ecdb1f8240cbb30389c1
	https://git.kernel.org/stable/c/7e5d91d3e6c62a9755b36f29c35288f06c3cd86b
	https://git.kernel.org/stable/c/f1ce9258bcbce2491f9f71f7882b6eed0b33ec65
	https://git.kernel.org/stable/c/6073afe64510c302b7a0683a01e32c012eff715d
	https://git.kernel.org/stable/c/e6bb9193974059ddbb0ce7763fa3882bd60d4dc3