CVE-2026-31536

Vulnerability

In the Linux kernel's SMB server, the smbdirect_send_batch processing can result in requests without the IB_SEND_SIGNALED flag. These requests are normally destroyed only when a subsequent request with the flag completes. However, if the connection is broken, all pending requests are signaled regardless of the flag, causing the completion handler to be invoked on already-freed or incorrectly managed memory.

Exploitation

An attacker with network access to a vulnerable SMB server over RDMA (e.g., using SMB Direct) could potentially trigger a connection break to force the unexpected completion. This does not require authentication if the SMB server allows anonymous connections. The resulting use-after-free or double-free can lead to kernel memory corruption.

Impact

Successful exploitation could allow an unauthenticated remote attacker to crash the system (denial of service) or potentially execute arbitrary code with kernel privileges. Given the CVSS score of 9.8, the impact is critical.

Mitigation

The vulnerability is fixed in the Linux kernel stable versions via commits [1], [2], and [3]. Administrators should apply the latest kernel updates from their distribution. No workaround is available.