CVE-2026-31537: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31537 is a synchronization flaw in the Linux kernel's SMB server component affecting the smbdirect_socket.send_io.bcredits implementation. The vulnerability causes corruption of reassembled SMB Direct data transfer message streams when an immediate (empty) send is triggered due to improper batch credit management per connection. It affects Linux kernel versions 5.15 through 6.18.10 and 6.19.0. The CVE was published on April 24, 2026, with patches released on April 28, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-821 (Incorrect Synchronization) — the SMB server's batch credit mechanism for smbdirect_socket.send_io.bcredits fails to properly serialize access when an immediate (empty) send is triggered, allowing multiple messages to be dispatched before the credit is returned. This desynchronization corrupts the stream of reassembled SMB Direct data transfer messages. The fix introduces a single batch credit per connection: once a code path acquires the credit, it may send messages until remaining_length reaches zero, at which point the credit is returned and the next logical send can proceed. Exploitation requires local access with low privileges (Red Hat Bugzilla, Feedly).

An attacker with local, low-privileged access can trigger data corruption in SMB Direct data transfer streams, compromising the integrity of data transmitted between SMB server and clients. The primary impact is high availability disruption — services relying on SMB Direct transfers may experience denial of service or unreliable operation due to malformed or incomplete data streams. There is no confidentiality impact, and the scope is limited to the affected system without lateral movement potential inherent to this vulnerability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface.

Upgrade the Linux kernel to a patched version: 6.18.11 or later (for the 5.15–6.18.x branch), 6.19.1 or later (for the 6.19.x branch), or 7.0 or later. Patch commits are available at git.kernel.org (commits 34abd408c8ba, 5ef18a2e66f2, and 79242e7b6bc6) (Red Hat Bugzilla). For systems that cannot be immediately patched, restrict local user access and apply network-level controls to limit SMB server exposure. Monitor SMB transfer operations for signs of data corruption or malformed transfers (Feedly).