HIGHCVE-2026-31539Published Modified CNA Linux
CVE-2026-31539: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available
In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between receiving the incoming recv at the hardware and processing the completion in the 'recv_done' functions we likely have a window where we grant credits, which don't really exist. So we better have a decicated counter for the available credits, which will be incremented when we posted new recv buffers and drained when we grant the credits to the peer.
Metrics
- CVSS v3.1
- 7.5
- Severity
- HIGH
- Fixed in
- 0
- Affected Products
- 2
Fix available
06.18.116.19.16e3c5052f9686192e178806e017b7377155f4bab7.0e811e60e1cc79923c4388146eb1fa26a7482731ef99996870222b598914a1f49d7375dc23752c237
Affected packages
- Linux / Linux< e811e60e1cc79923c4388146eb1fa26a7482731e (from 5fb9b459b3686e366640edd4e62805ef7b4de927) · < f99996870222b598914a1f49d7375dc23752c237 (from 5fb9b459b3686e366640edd4e62805ef7b4de927) · < 6e3c5052f9686192e178806e017b7377155f4bab (from 5fb9b459b3686e366640edd4e62805ef7b4de927)
- Linux / Linux6.18Fixed in 0, 6.18.11, 6.19.1, 7.0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H