CVE-2026-31538

A race condition exists in the Linux kernel's SMB server implementation. The vulnerability stems from the flawed logic of managing receive (recv) credits by counting posted recv_io and granted credits, without a dedicated counter for available credits [1]. This creates a window where the server may grant credits that are not actually available, leading to a resource exhaustion scenario [1].

An attacker can exploit this by sending crafted SMB requests that manipulate credit counts during the race window, bypassing authentication as no special privileges are required to trigger the flaw. The attack is network-based and can be performed remotely, exploiting the timing gap between hardware receipt of incoming data and processing of completions [1].

The primary impact is a denial of service (DoS) condition, as excessive credit grants can exhaust kernel memory or resources. The vulnerability also results in system instability and potential crashes, as described in the official description [1].

Patches have been merged into the Linux kernel stable branches, as referenced in commits [2] and [3]. Users are advised to apply these updates immediately. This issue is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of publication.