CVE-2025-38711 – A deadlock vulnerability exists in the Linux ke... (How to Fix)

Q: What is the severity of CVE-2025-38711?

CVE-2025-38711 has a CVSS score of 5.5 (MEDIUM). A deadlock vulnerability exists in the Linux kernel's SMB server implementation when handling file linking operations with ReplaceIfExists flag. This affects systems running vulnerable kernel versions with ksmbd (kernel SMB server) enabled, potentially causing denial of service. The vulnerability is triggered during specific SMB file operations.

📋 TL;DR

A deadlock vulnerability exists in the Linux kernel's SMB server implementation when handling file linking operations with ReplaceIfExists flag. This affects systems running vulnerable kernel versions with ksmbd (kernel SMB server) enabled, potentially causing denial of service. The vulnerability is triggered during specific SMB file operations.

💻 Affected Systems

Products:

Linux kernel with ksmbd module

Versions: Kernel versions containing vulnerable ksmbd code before fixes were applied

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if ksmbd (kernel SMB server) is enabled and in use. Many distributions don't enable ksmbd by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete denial of service for SMB services on affected systems, requiring system reboot to restore functionality.

🟠

Likely Case

Temporary service disruption for SMB file operations when specific linking operations are attempted.

🟢

If Mitigated

No impact if ksmbd is disabled or patched kernel is used.

🌐 Internet-Facing: MEDIUM - SMB services exposed to internet could be targeted for DoS attacks.

🏢 Internal Only: MEDIUM - Internal attackers or misconfigured clients could trigger the deadlock.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires SMB client access and ability to perform specific file linking operations with ReplaceIfExists flag.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 1e858a7a51c7b8b009d8f246de7ceb7743b44a71 and related fixes

Vendor Advisory: https://git.kernel.org/stable/c/1e858a7a51c7b8b009d8f246de7ceb7743b44a71

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify ksmbd module loads correctly.

🔧 Temporary Workarounds

Disable ksmbd module

Linux

Prevent loading of vulnerable ksmbd kernel module

echo 'blacklist ksmbd' >> /etc/modprobe.d/blacklist-ksmbd.conf
rmmod ksmbd

🧯 If You Can't Patch

Disable SMB services using ksmbd and use alternative SMB implementations
Restrict SMB client access to trusted sources only

🔍 How to Verify

Check if Vulnerable:

Check if ksmbd module is loaded: lsmod | grep ksmbd. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated and ksmbd module version matches patched kernel. Test SMB linking operations with ReplaceIfExists flag.

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing deadlock warnings
SMB service becoming unresponsive
Processes stuck in D state

Network Indicators:

SMB connections failing during file linking operations
Increased SMB protocol errors

SIEM Query:

source="kernel" AND ("deadlock" OR "hung task") AND "ksmbd"

📊 Metadata

CVE ID: CVE-2025-38711

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-667

EPSS Score: 0.01% exploit probability (1.4th percentile)

Published: September 4, 2025

Last Updated: January 9, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38711, you might also want to check these: