CVE-2026-31535

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31535", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.113Z", "datePublished": "2026-04-24T14:30:23.540Z", "dateUpdated": "2026-11-05T21:45:06.795Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:10:39.307Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smbdirect.c"], "versions": [{"version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "lessThan": "f664e6e8a81103cb45c8802a9bc7499e0902c458", "status": "affected", "versionType": "git"}, {"version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "lessThan": "be8845ad5d6558703d20567d8702155598325db8", "status": "affected", "versionType": "git"}, {"version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "lessThan": "9911b1ed187a770a43950bf51f340ad4b7beecba", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smbdirect.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.11", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.1", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f664e6e8a81103cb45c8802a9bc7499e0902c458"}, {"url": "https://git.kernel.org/stable/c/be8845ad5d6558703d20567d8702155598325db8"}, {"url": "https://git.kernel.org/stable/c/9911b1ed187a770a43950bf51f340ad4b7beecba"}], "title": "smb: client: make use of smbdirect_socket.recv_io.credits.available", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31535", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:37:58.578551Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:06.795Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31535", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:37:58.578551Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:38:00.093Z"}}], "cna": {"title": "smb: client: make use of smbdirect_socket.recv_io.credits.available", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "lessThan": "f664e6e8a81103cb45c8802a9bc7499e0902c458", "versionType": "git"}, {"status": "affected", "version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "lessThan": "be8845ad5d6558703d20567d8702155598325db8", "versionType": "git"}, {"status": "affected", "version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "lessThan": "9911b1ed187a770a43950bf51f340ad4b7beecba", "versionType": "git"}], "programFiles": ["fs/smb/client/smbdirect.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.11", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.1", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/smbdirect.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f664e6e8a81103cb45c8802a9bc7499e0902c458"}, {"url": "https://git.kernel.org/stable/c/be8845ad5d6558703d20567d8702155598325db8"}, {"url": "https://git.kernel.org/stable/c/9911b1ed187a770a43950bf51f340ad4b7beecba"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.11", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.1", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:10:39.307Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31535", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:06.795Z", "dateReserved": "2026-03-09T15:48:24.113Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-24T14:30:23.540Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smbdirect.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f664e6e8a81103cb45c8802a9bc7499e0902c458", "status": "affected", "version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "versionType": "git"}, {"lessThan": "be8845ad5d6558703d20567d8702155598325db8", "status": "affected", "version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "versionType": "git"}, {"lessThan": "9911b1ed187a770a43950bf51f340ad4b7beecba", "status": "affected", "version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smbdirect.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.11", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D06FE45-F85F-4F59-A12C-C72C3C580DA4", "versionEndExcluding": "6.18.11", "versionStartIncluding": "6.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE543C0D-A06B-414F-A403-CB1E088F261E", "versionEndExcluding": "6.19.1", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: hacer uso de smbdirect_socket.recv_io.credits.available\n\nLa l\u00f3gica de gestionar los cr\u00e9ditos de recv contando los recv_io publicados y los cr\u00e9ditos concedidos es propensa a condiciones de carrera.\n\nEsto se debe a que el par podr\u00eda haber consumido ya un cr\u00e9dito, pero entre la recepci\u00f3n del recv entrante en el hardware y el procesamiento de la finalizaci\u00f3n en las funciones \u2019recv_done\u2019, es probable que tengamos una ventana donde concedemos cr\u00e9ditos que en realidad no existen.\n\nAs\u00ed que es mejor tener un contador dedicado para los cr\u00e9ditos disponibles, el cual ser\u00e1 incrementado cuando publiquemos nuevos b\u00faferes de recv y vaciado cuando concedamos los cr\u00e9ditos al par."}], "id": "CVE-2026-31535", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31535", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:37:58.578551Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:27.427", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9911b1ed187a770a43950bf51f340ad4b7beecba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be8845ad5d6558703d20567d8702155598325db8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f664e6e8a81103cb45c8802a9bc7499e0902c458"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: smb: client: make use of smbdirect_socket.recv_io.credits.available", "id": "2461468", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461468"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel. A race condition exists in the SMB client's receive credit management, specifically in how `smbdirect_socket.recv_io.credits.available` are handled. This could lead to incorrect credit allocation, potentially causing instability or unexpected behavior within the system."], "name": "CVE-2026-31535", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31535\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31535\nhttps://lore.kernel.org/linux-cve-announce/2026042433-CVE-2026-31535-1c83@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5fb9b459b3686e366640edd4e62805ef7b4de927,f664e6e8a81103cb45c8802a9bc7499e0902c458)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5fb9b459b3686e366640edd4e62805ef7b4de927,be8845ad5d6558703d20567d8702155598325db8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5fb9b459b3686e366640edd4e62805ef7b4de927,9911b1ed187a770a43950bf51f340ad4b7beecba)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.11,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.1,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T23:48:40.784185+00:00", "value": {"mitigation_remediation": ["Apply a Linux kernel update that includes the fix for the race condition (CWE-367) in SMB client credit management.", "If immediate kernel upgrade is not possible, disable SMB client functionality on the affected host or restrict SMB traffic using firewall rules to reduce exposure to the race window.", "Enable verbose logging for SMB client operations so any anomalous credit grant behavior associated with the race condition can be detected early, allowing operators to respond before a full denial of service occurs."], "summary": {"action": "Apply patch", "impact": "Service disruption"}, "threat_synthesis": {"affected_systems": "Affected systems include any machine running a Linux kernel that incorporates the SMB client code before the kernel commit that introduced a dedicated counter for available credits. No specific kernel version numbers are listed, so essentially every Linux installation that has not yet applied the fix is potentially impacted.", "description_and_impact": "The vulnerability exists in the Linux kernel\u2019s SMB client where the logic for handling receive credits uses a counter that is subject to a race between credit granting and credit consumption by the peer. The race condition arises because the code may grant credits that have already been consumed, creating a window where the server can be asked to provide more data than it authorized. Based on the description, it is inferred that this improper credit accounting could allow an attacker to cause the client to misbehave, potentially leading to a denial of service or other operational disruption. The weakness is identified as CWE-367, a race condition.", "risk_and_exploitability": "The CVSS score of 4.7 indicates medium severity. The EPSS score is under 1%, showing a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in CISA KEV. Based on the nature of this race, it is inferred that an attacker would need to send carefully timed SMB traffic to trigger the race window; practical exploitation would therefore require precise coordination, making attacks difficult but not theoretically impossible. Overall the risk remains significant due to potential service disruption, but the likelihood of exploitation is low."}}}}, "created": "2026-04-27T19:15:11.630183+00:00", "updated": "2026-04-29T00:00:13.806288+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}