CVE 7.5 HIGH

smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available_CVE-2026-31539

7.5 / 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available

The logic off managing recv credits by counting posted recv_io and
granted credits is racy.

That's because the peer might already consumed a credit,
but between receiving the incoming recv at the hardware
and processing the completion in the 'recv_done' functions
we likely have a window where we grant credits, which
don't really exist.

So we better have a decicated counter for the
available credits, which will be incremented
when we posted new recv buffers and drained when
we grant the credits to the peer.

Basic Information

ID CVE-2026-31539
Source Linux
Published Apr 24, 2026 at 14:30
Modified Apr 27, 2026 at 14:03

Affected Product

Vendor Linux
Product Linux
Version 5fb9b459b3686e366640edd4e62805ef7b4de927
Affected Versions Linux Linux 5fb9b459b3686e366640edd4e62805ef7b4de927
Linux Linux 5fb9b459b3686e366640edd4e62805ef7b4de927
Linux Linux 5fb9b459b3686e366640edd4e62805ef7b4de927
Linux Linux 6.18

References

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.