An unauthenticated remote denial of service vulnerability in the Linux kernel SMB server allows attackers to exhaust connection pools and crash server availability.

This flaw involves a resource management error within the ksmbd server component, specifically failing to decrement the active_num_conn counter during transport allocation failures, which can be triggered by unauthenticated remote attackers over TCP port 445.

A successful exploit leads to a persistent denial of service condition where the affected SMB server rejects all subsequent connection attempts until the module is reloaded. This disruption halts file sharing and storage services, impacting business operations. The CVSS score of 7.5 reflects the high availability impact despite the lack of confidentiality or integrity compromise.

Immediate Action: Update the Linux kernel to fixed versions such as 5.15.210, 6.1.175, 6.6.136, 6.12.84, or later depending on your active kernel branch.

Proactive Monitoring: Monitor system logs for unusual spikes in connection failures or unexpected drops in active SMB client sessions.

Compensating Controls: Restrict network access to TCP port 445 using firewall rules to limit exposure to trusted internal networks only.

Public Exploit Available: false

System administrators must prioritize applying the latest upstream kernel patches to affected systems running the ksmbd server. Restricting exposure of SMB services to external networks provides essential defense-in-depth while patches are scheduled and deployed.