CVE-2026-31538 (GCVE-0-2026-31538)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:30 – Updated: 2026-08-05 12:23
VLAI
Title
smb: server: make use of smbdirect_socket.recv_io.credits.available
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: server: make use of smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between receiving the incoming recv at the hardware and processing the completion in the 'recv_done' functions we likely have a window where we grant credits, which don't really exist. So we better have a decicated counter for the available credits, which will be incremented when we posted new recv buffers and drained when we grant the credits to the peer. This fixes regression Namjae reported with the 6.18 release.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 89b021a72663c4d96d8a8b85272bb42d991a1c6f , < 66c082e3d4651e8629a393a9e182b01eb50fb0a3 (git)
Affected: 89b021a72663c4d96d8a8b85272bb42d991a1c6f , < 809cbd31aa4f87a1b889532244c9cf30eb022385 (git)
Affected: 89b021a72663c4d96d8a8b85272bb42d991a1c6f , < 26ad87a2cfb8c1384620d1693a166ed87303046e (git)
Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.11 , ≤ 6.18.* (semver)
Unaffected: 6.19.1 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/transport_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66c082e3d4651e8629a393a9e182b01eb50fb0a3",
              "status": "affected",
              "version": "89b021a72663c4d96d8a8b85272bb42d991a1c6f",
              "versionType": "git"
            },
            {
              "lessThan": "809cbd31aa4f87a1b889532244c9cf30eb022385",
              "status": "affected",
              "version": "89b021a72663c4d96d8a8b85272bb42d991a1c6f",
              "versionType": "git"
            },
            {
              "lessThan": "26ad87a2cfb8c1384620d1693a166ed87303046e",
              "status": "affected",
              "version": "89b021a72663c4d96d8a8b85272bb42d991a1c6f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/transport_rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.11",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat\u0027s because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the \u0027recv_done\u0027 functions\nwe likely have a window where we grant credits, which\ndon\u0027t really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer.\n\nThis fixes regression Namjae reported with\nthe 6.18 release."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - SMB Direct is a network-facing ksmbd RDMA transport listening on SMB/RDMA ports, and the vulnerable credit path is reached by packets from a remote SMB Direct peer. The attacker only needs network access to the exposed SMB Direct service.\nAC:L - The race is between receive completion processing and server credit grants, but the attacker controls the RDMA connection traffic and can repeatedly pipeline/flood requests to hit the window. No unusual victim-side condition is required beyond SMB Direct being enabled.\nPR:N - The affected path is in SMB Direct transport negotiation and data transfer handling before SMB session authentication is required. A remote unauthenticated peer can reach the credit accounting logic.\nUI:N - No victim user action is needed after the ksmbd SMB Direct service is running. The attacker triggers the issue by connecting and sending SMB Direct traffic.\nS:U - The impact remains within the kernel ksmbd/SMB Direct service security authority. There is no VM escape, sandbox escape, or cross-scope boundary change.\nC:N - The bug is receive-credit accounting, not an out-of-bounds access, use-after-free, or disclosure path. It does not provide a defensible kernel memory read primitive.\nI:N - Over-granting receive credits does not grant authorization or create a write primitive into kernel memory. The RDMA receive path consumes posted receive buffers and fails/disconnects when credits are invalid rather than allowing attacker-controlled memory modification.\nA:H - The peer can be granted credits for receive buffers that no longer exist, leading to RDMA receive-not-ready/QP errors or disconnects. Because this can be triggered remotely and repeatedly without authentication, it can deny SMB Direct service availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:22.947Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66c082e3d4651e8629a393a9e182b01eb50fb0a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/809cbd31aa4f87a1b889532244c9cf30eb022385"
        },
        {
          "url": "https://git.kernel.org/stable/c/26ad87a2cfb8c1384620d1693a166ed87303046e"
        }
      ],
      "title": "smb: server: make use of smbdirect_socket.recv_io.credits.available",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31538",
    "datePublished": "2026-04-24T14:30:25.598Z",
    "dateReserved": "2026-03-09T15:48:24.113Z",
    "dateUpdated": "2026-08-05T12:23:22.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31538",
      "date": "2026-08-07",
      "epss": "0.00426",
      "percentile": "0.3513"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31538\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-24T15:16:27.740\",\"lastModified\":\"2026-06-17T10:33:56.200\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: server: make use of smbdirect_socket.recv_io.credits.available\\n\\nThe logic off managing recv credits by counting posted recv_io and\\ngranted credits is racy.\\n\\nThat\u0027s because the peer might already consumed a credit,\\nbut between receiving the incoming recv at the hardware\\nand processing the completion in the \u0027recv_done\u0027 functions\\nwe likely have a window where we grant credits, which\\ndon\u0027t really exist.\\n\\nSo we better have a decicated counter for the\\navailable credits, which will be incremented\\nwhen we posted new recv buffers and drained when\\nwe grant the credits to the peer.\\n\\nThis fixes regression Namjae reported with\\nthe 6.18 release.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/transport_rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"89b021a72663c4d96d8a8b85272bb42d991a1c6f\",\"lessThan\":\"66c082e3d4651e8629a393a9e182b01eb50fb0a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"89b021a72663c4d96d8a8b85272bb42d991a1c6f\",\"lessThan\":\"809cbd31aa4f87a1b889532244c9cf30eb022385\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"89b021a72663c4d96d8a8b85272bb42d991a1c6f\",\"lessThan\":\"26ad87a2cfb8c1384620d1693a166ed87303046e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/transport_rdma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.11\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.1\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18\",\"versionEndExcluding\":\"6.18.11\",\"matchCriteriaId\":\"1D06FE45-F85F-4F59-A12C-C72C3C580DA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.1\",\"matchCriteriaId\":\"EE543C0D-A06B-414F-A403-CB1E088F261E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/26ad87a2cfb8c1384620d1693a166ed87303046e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66c082e3d4651e8629a393a9e182b01eb50fb0a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/809cbd31aa4f87a1b889532244c9cf30eb022385\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:26:14+00:00",
      "cve": "CVE-2026-31538",
      "id": "CVE-2026-31538",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: server: make use of smbdirect_socket.recv_io.credits.available",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31538.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-06T01:24:37Z",
      "cve": "CVE-2026-31538",
      "id": "CVE-2026-31538",
      "initial_release_date": "2026-04-25T01:40:01Z",
      "product_status:known_not_affected": "319",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31538",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31538.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.