CVE-2026-31535: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31535 is a race condition vulnerability in the Linux kernel's SMB client component, specifically in the smbdirect_socket receive credit management logic. The flaw was disclosed on April 24, 2026, and affects Linux kernel versions 6.18.0–6.18.10 and 6.19.0. It carries a CVSS v3.1 base score of 4.7 (Medium), reflecting a local, high-complexity attack requiring low privileges (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use / TOCTOU Race Condition). The SMB client's logic for managing receive (recv) credits counts posted recv_io buffers and granted credits, but a timing window exists between when incoming data is received at the hardware level and when the recv_done completion handler processes it. During this window, the kernel may grant credits to the peer that do not actually exist, because the peer may have already consumed a credit before the completion is processed. The fix introduces a dedicated smbdirect_socket.recv_io.credits.available counter that is incremented when new recv buffers are posted and decremented when credits are granted to the peer, eliminating the race (Red Hat Bugzilla).

Successful exploitation of this vulnerability allows a local, low-privileged attacker to trigger kernel crashes through the race condition in SMB Direct (RDMA-based SMB) credit management, resulting in a denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Affected systems using SMB Direct connectivity may experience loss of SMB functionality and potential kernel panics (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017%, reflecting very low probability of exploitation in the near term. Exploitation requires local access, low privileges, and high attack complexity, significantly limiting the practical attack surface (Red Hat Advisory).

Update the Linux kernel to a patched version: 6.18.11 or later for the 6.18.x branch, 6.19.1 or later for the 6.19.x branch, or kernel 7.0 and later. Patch commits are available at git.kernel.org (commits 9911b1ed187a, be8845ad5d65, and f664e6e8a811). Given the medium severity and low exploitation likelihood, this can be addressed during regular patching cycles. Monitor kernel logs and SMB client connectivity for unexpected crashes on affected systems (Red Hat Advisory, Red Hat Bugzilla).