CVE-2026-31538

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31538", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.113Z", "datePublished": "2026-04-24T14:30:25.598Z", "dateUpdated": "2026-08-05T12:23:22.947Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:23:22.947Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer.\n\nThis fixes regression Namjae reported with\nthe 6.18 release."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - SMB Direct is a network-facing ksmbd RDMA transport listening on SMB/RDMA ports, and the vulnerable credit path is reached by packets from a remote SMB Direct peer. The attacker only needs network access to the exposed SMB Direct service.\nAC:L - The race is between receive completion processing and server credit grants, but the attacker controls the RDMA connection traffic and can repeatedly pipeline/flood requests to hit the window. No unusual victim-side condition is required beyond SMB Direct being enabled.\nPR:N - The affected path is in SMB Direct transport negotiation and data transfer handling before SMB session authentication is required. A remote unauthenticated peer can reach the credit accounting logic.\nUI:N - No victim user action is needed after the ksmbd SMB Direct service is running. The attacker triggers the issue by connecting and sending SMB Direct traffic.\nS:U - The impact remains within the kernel ksmbd/SMB Direct service security authority. There is no VM escape, sandbox escape, or cross-scope boundary change.\nC:N - The bug is receive-credit accounting, not an out-of-bounds access, use-after-free, or disclosure path. It does not provide a defensible kernel memory read primitive.\nI:N - Over-granting receive credits does not grant authorization or create a write primitive into kernel memory. The RDMA receive path consumes posted receive buffers and fails/disconnects when credits are invalid rather than allowing attacker-controlled memory modification.\nA:H - The peer can be granted credits for receive buffers that no longer exist, leading to RDMA receive-not-ready/QP errors or disconnects. Because this can be triggered remotely and repeatedly without authentication, it can deny SMB Direct service availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/transport_rdma.c"], "versions": [{"version": "89b021a72663c4d96d8a8b85272bb42d991a1c6f", "lessThan": "66c082e3d4651e8629a393a9e182b01eb50fb0a3", "status": "affected", "versionType": "git"}, {"version": "89b021a72663c4d96d8a8b85272bb42d991a1c6f", "lessThan": "809cbd31aa4f87a1b889532244c9cf30eb022385", "status": "affected", "versionType": "git"}, {"version": "89b021a72663c4d96d8a8b85272bb42d991a1c6f", "lessThan": "26ad87a2cfb8c1384620d1693a166ed87303046e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/transport_rdma.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.11", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.1", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/66c082e3d4651e8629a393a9e182b01eb50fb0a3"}, {"url": "https://git.kernel.org/stable/c/809cbd31aa4f87a1b889532244c9cf30eb022385"}, {"url": "https://git.kernel.org/stable/c/26ad87a2cfb8c1384620d1693a166ed87303046e"}], "title": "smb: server: make use of smbdirect_socket.recv_io.credits.available", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/transport_rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "66c082e3d4651e8629a393a9e182b01eb50fb0a3", "status": "affected", "version": "89b021a72663c4d96d8a8b85272bb42d991a1c6f", "versionType": "git"}, {"lessThan": "809cbd31aa4f87a1b889532244c9cf30eb022385", "status": "affected", "version": "89b021a72663c4d96d8a8b85272bb42d991a1c6f", "versionType": "git"}, {"lessThan": "26ad87a2cfb8c1384620d1693a166ed87303046e", "status": "affected", "version": "89b021a72663c4d96d8a8b85272bb42d991a1c6f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/transport_rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.11", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D06FE45-F85F-4F59-A12C-C72C3C580DA4", "versionEndExcluding": "6.18.11", "versionStartIncluding": "6.18", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE543C0D-A06B-414F-A403-CB1E088F261E", "versionEndExcluding": "6.19.1", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer.\n\nThis fixes regression Namjae reported with\nthe 6.18 release."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: servidor: hacer uso de smbdirect_socket.recv_io.credits.available\n\nLa l\u00f3gica de gestionar los cr\u00e9ditos de recepci\u00f3n contando los recv_io publicados y los cr\u00e9ditos concedidos es propensa a condiciones de carrera.\n\nEsto se debe a que el par podr\u00eda haber consumido ya un cr\u00e9dito, pero entre la recepci\u00f3n del recv entrante en el hardware y el procesamiento de la finalizaci\u00f3n en las funciones \u2019recv_done\u2019 es probable que tengamos una ventana donde concedemos cr\u00e9ditos que en realidad no existen.\n\nAs\u00ed que es mejor tener un contador dedicado para los cr\u00e9ditos disponibles, el cual se incrementar\u00e1 cuando publiquemos nuevos b\u00faferes de recepci\u00f3n y se vaciar\u00e1 cuando concedamos los cr\u00e9ditos al par.\n\nEsto corrige la regresi\u00f3n que Namjae inform\u00f3 con la versi\u00f3n 6.18."}], "id": "CVE-2026-31538", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-04-24T15:16:27.740", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/26ad87a2cfb8c1384620d1693a166ed87303046e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66c082e3d4651e8629a393a9e182b01eb50fb0a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/809cbd31aa4f87a1b889532244c9cf30eb022385"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: smb: server: make use of smbdirect_socket.recv_io.credits.available", "id": "2461481", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461481"}, "csaw": false, "cwe": "CWE-821", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: server: make use of smbdirect_socket.recv_io.credits.available\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer.\nThis fixes regression Namjae reported with\nthe 6.18 release.", "A flaw was found in the Linux kernel's Server Message Block (SMB) direct server. A race condition exists in the logic responsible for managing receive credits. This occurs because the system's method of counting posted receive input/output (recv_io) and granted credits is susceptible to timing issues. Consequently, the server may grant credits that have already been consumed by the peer, leading to incorrect credit management and potential instability."], "name": "CVE-2026-31538", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31538\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31538\nhttps://lore.kernel.org/linux-cve-announce/2026042434-CVE-2026-31538-a6f7@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[89b021a72663c4d96d8a8b85272bb42d991a1c6f,66c082e3d4651e8629a393a9e182b01eb50fb0a3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[89b021a72663c4d96d8a8b85272bb42d991a1c6f,809cbd31aa4f87a1b889532244c9cf30eb022385)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[89b021a72663c4d96d8a8b85272bb42d991a1c6f,26ad87a2cfb8c1384620d1693a166ed87303046e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.11,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.1,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T23:47:31.940613+00:00", "value": {"mitigation_remediation": ["Upgrade the kernel to a release that includes the SMB receive\u2011credit race condition fix", "Disable SMB1 and other legacy SMB protocols to reduce exposure", "Configure firewall or network segmentation to limit SMB traffic to trusted hosts or internal network"], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The issue is present in the SMB server code of the Linux kernel itself; it is not confined to a specific distribution. All kernel releases that include the current SMB implementation before the patch \u2013 including those preceding version 6.18 \u2013 are affected unless the system\u2019s kernel has been upgraded to a version that incorporates the indicated fix. The vulnerability affects all architectures supported by the Linux kernel\u2019s SMB stack.", "description_and_impact": "The vulnerability arises from a race condition in the Linux kernel\u2019s SMB server when managing receive credits. The counter that tracks posted receive buffers and granted credits is not isolated, so a peer could consume a credit while the kernel is still processing the previous receive. During the brief window where the kernel grants additional credits before the initial grant has been fully accounted for, the available credit count can temporarily exceed the number of actually posted buffers. This inconsistency may lead the SMB server to believe it has more credits than it actually does, which can result in the service using more resources than intended and potentially causing a denial of service.", "risk_and_exploitability": "The CVSS score of 7.5 places this flaw in the high severity range. An EPSS score of below 1\u202f% indicates that the probability of real\u2011world exploitation is currently low. The flaw can be triggered via normal SMB traffic from any network host that can reach the SMB server provided by the kernel. The likely attack vector is a remote SMB request, inferred from the description that the vulnerability is activated by SMB traffic. As it is not listed in the CISA KEV catalog, no large\u2011scale active exploitation is known. However, the potential for denial of service warrants prompt attention."}}}}, "created": "2026-04-27T19:15:11.628621+00:00", "title": "Race Condition in SMB Server Receive Credit Management", "updated": "2026-04-29T00:00:13.799830+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}