CVE-2026-31539

Vulnerability

Description

A race condition exists in the Linux kernel's SMB Direct (smbdirect) module in the management of receive (recv) credits. The original logic tracked credits by counting posted recv I/O operations and granted credits separately, but this approach is racy. Between the hardware receiving an incoming message and the completion being processed in the recv_done functions, the peer may have already consumed a credit, yet the kernel might grant additional credits that do not actually exist [1][2][3].

Exploitation

An attacker on the same network as a system using SMB Direct (e.g., over RDMA) could potentially exploit this race condition by carefully timing message delivery to trigger the window where credits are granted incorrectly. No authentication is required beyond network access to the SMB Direct service, as the vulnerability lies in the credit accounting logic that operates before any higher-layer validation.

Impact

Successful exploitation could lead to resource exhaustion or denial of service, as the kernel may grant more credits than available, causing the system to overcommit receive buffers. This could result in memory corruption, system instability, or a complete denial of service for SMB Direct connections.

Mitigation

The fix introduces a dedicated counter for available credits, which is incremented when new recv buffers are posted and decremented when credits are granted to the peer, eliminating the race condition. Patches have been committed to the Linux kernel stable tree [1][2][3]. Users should apply the latest kernel updates to mitigate this vulnerability.