keymaker-arch/ksmbdrainProof-of-concept exploit for CVE-2025-38501 that remotely exhausts KSMBD SMB server connection limits via incomplete TCP handshakes, enabling denial-of-service attacks against Linux kernel SMB implementations.
Proof-of-Concept exploit for KSMBDrain (CVE-2025-38501). It can remotely exhaust the KSMBD server's connection limit.
A remote attacker can exhaust a KSMBD server’s maximum connection limit by performing a TCP 3-way handshake and then not responding to further packets. By default, the KSMBD server will hold such connections indefinitely, allowing an attacker to consume all available connections. While a timeout can be configured in the user-space configuration file (with a minimum of 1 minute), an attacker from a single IP address can still cause a DoS to the SMB service by repeatedly initiating such connections.
poc.py as needed, then run the scriptI would like to thank @FFreestanding in helping reproducing the bug and developing the PoC.
This proof-of-concept (PoC) code is provided for educational and research purposes only.
Use this code responsibly and only on systems you own or have explicit permission to test.
The authors and contributors are not responsible for any misuse or damage caused by this code.