CVE-2026-31539: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31539 is a race condition vulnerability in the Linux kernel's SMB Direct (smbdirect) implementation affecting recv credits management logic. The flaw exists because a remote peer may consume a credit before the incoming receive completion is processed, creating a timing window where non-existent credits are granted. It affects Linux kernel versions 6.18.x before 6.18.11 and 6.19.x before 6.19.1. Disclosed on April 24, 2026, it carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-821 (Incorrect Synchronization). In the smbdirect subsystem, recv credits are managed by counting posted recv_io entries and granted credits, but this approach is inherently racy: a peer may consume a credit between the hardware receiving an incoming message and the recv_done completion handler processing it. This window allows credits to be granted to the peer that do not actually exist, as there is no dedicated atomic counter tracking truly available credits. The fix introduces a dedicated smbdirect_socket.recv_io.credits.available counter that is incremented when new recv buffers are posted and decremented when credits are granted to the peer (Red Hat Bugzilla, Kernel Patch).

Successful exploitation of this race condition can lead to incorrect credit accounting in SMB Direct communications, potentially enabling a remote peer to consume more credits than are actually available. This results in denial of service conditions where legitimate SMB Direct connections are disrupted due to credit exhaustion or corrupted credit state, impacting the reliability and availability of SMB over RDMA (SMB Direct) protocol implementations. There is no impact to confidentiality or integrity; the vulnerability is limited to availability (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The attack vector is network-based and requires no authentication or user interaction, but exploitation requires precise timing to abuse the race condition window (Red Hat Advisory).

Update the Linux kernel to a patched version: 6.18.11 or later, 6.19.1 or later, or 7.0 and later. Fixes have been committed to the stable kernel branches via three separate commits. Organizations using SMB Direct (SMB over RDMA) should prioritize patching affected systems. If immediate patching is not possible, consider disabling SMB Direct functionality as a temporary workaround to reduce exposure (Red Hat Advisory, Kernel Patch).