CVE-2026-31537

The Linux kernel's SMB server (smbdirect) contains a vulnerability where an immediate (empty) send can corrupt the stream of reassembled data transfer messages. The root cause is improper credit management in the smbdirect_socket.send_io path, leading to out-of-order or corrupted data reassembly.

The vulnerability can be triggered by a remote attacker with network access to the SMB server. No authentication is explicitly required, as the issue occurs during data transfer handling. An attacker could craft a specific sequence of SMB Direct messages to induce an empty send, causing the corruption.

Successful exploitation could lead to data integrity issues in SMB Direct communications, potentially resulting in denial of service or data corruption. The impact is limited to the SMB over RDMA (smbdirect) functionality.

The fix introduces a single 'batch' credit per connection, ensuring that only one logical send is in progress at a time. This patch has been applied to the Linux kernel stable tree via commits [1][2][3]. Users are advised to update to the latest kernel version to mitigate this vulnerability.