CVE-2026-31535: Linux Kernel Race Condition Vulnerability

CVE-2026-31535 Overview

CVE-2026-31535 is a race condition vulnerability in the Linux kernel's SMB (Server Message Block) client implementation. The flaw resides in the SMB Direct (SMBDirect/RDMA) credit management logic used by the cifs/smb client subsystem. The issue stems from a Time-of-Check Time-of-Use (TOCTOU) condition [CWE-367] when the client counts posted recv_io buffers and granted credits to track available receive credits. A peer may consume a credit during the window between hardware reception and completion processing in the recv_done path, leading the client to grant credits that do not actually exist.

Critical Impact
A local, authenticated attacker can trigger inconsistent SMB Direct credit state, causing high-availability impact on systems that mount SMB shares over RDMA.

Affected Products

Linux Kernel (upstream smb client / SMB Direct transport)
Distributions shipping vulnerable cifs.ko builds prior to the fix commits
Systems mounting SMB shares over RDMA (SMB Direct) transports

Discovery Timeline

2026-04-24 - CVE-2026-31535 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31535

Vulnerability Analysis

The Linux kernel SMB client uses SMB Direct, an RDMA-based transport, to exchange data with SMB servers. SMB Direct relies on a credit-based flow control mechanism. Each side advertises credits representing how many receive buffers are posted and available to absorb incoming messages. Prior to the patch, the client computed available receive credits by indirectly correlating the number of posted recv_io operations with the credits it had previously granted to the peer.

This indirect accounting creates a race window. The peer may already have consumed a credit by transmitting a message that has arrived at the local hardware but has not yet been processed by the recv_done completion handler. During that window, the client can incorrectly grant additional credits to the peer, effectively over-committing receive buffers that are not actually available. The fix introduces a dedicated smbdirect_socket.recv_io.credits.available counter that is incremented when receive buffers are posted and decremented when credits are granted to the peer, removing the racy correlation.

Root Cause

The root cause is a TOCTOU race [CWE-367] in receive-credit accounting within the SMB Direct client transport. Credit availability was derived from two non-atomically coupled values rather than tracked in a single, authoritative counter.

Attack Vector

Exploitation requires local access with low privileges on a host that uses SMB Direct as the SMB transport. The attack complexity is high because the attacker must reliably hit a narrow timing window between hardware receive and completion processing. Successful exploitation does not disclose data or modify integrity but degrades availability of the SMB client transport, potentially leading to hangs, dropped connections, or kernel-side errors on the affected mount.

No verified public exploit code is available. The vulnerability is described in the upstream commit messages referenced by the Kernel Git Commit 9911b1e, Kernel Git Commit be8845a, and Kernel Git Commit f664e6e.

Detection Methods for CVE-2026-31535

Indicators of Compromise

Kernel log entries from the cifs or smbd modules referencing credit exhaustion, unexpected disconnects, or recv_done errors on SMB Direct mounts.
Repeated SMB Direct session resets or RDMA queue pair (QP) transitions to the error state on hosts mounting SMB shares over RDMA.
Unexplained stalls or hangs of processes performing I/O against cifs mounts on hosts with active SMB Direct transports.

Detection Strategies

Inventory Linux hosts running cifs.ko over RDMA and compare running kernel versions against the patched stable releases linked in the kernel.org commits.
Monitor dmesg and journalctl -k for smbd: and cifs: warnings related to credits, posted receives, or completion handling.
Correlate SMB client transport errors with workload patterns that issue concurrent SMB operations across multiple sessions.

Monitoring Recommendations

Forward kernel logs from SMB Direct clients into a centralized log pipeline and alert on cifs/smbd credit and transport errors.
Track RDMA interface counters (/sys/class/infiniband/*/ports/*/counters/) for abnormal QP error transitions on SMB client hosts.
Maintain inventory of kernel build versions across the fleet to identify hosts running unpatched smb client code.

How to Mitigate CVE-2026-31535

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org commits to all Linux hosts that mount SMB shares over RDMA.
Restrict local access on multi-tenant systems where users can trigger SMB Direct I/O against attacker-influenced workloads.
Where patching is delayed, prefer TCP-based SMB transports over SMB Direct for the affected mounts.

Patch Information

The fix introduces a dedicated smbdirect_socket.recv_io.credits.available counter to remove the racy credit accounting. The upstream resolution is distributed across three commits: Kernel Git Commit 9911b1e, Kernel Git Commit be8845a, and Kernel Git Commit f664e6e. Consume the patched kernel version provided by your Linux distribution as soon as it becomes available.

Workarounds

Disable the SMB Direct transport for cifs mounts and fall back to TCP by ensuring mounts do not negotiate RDMA (omit the rdma mount option).
Unload cifs.ko on hosts that do not require SMB client functionality to remove the attack surface entirely.
Limit which local users can issue I/O against SMB Direct mounts via filesystem permissions and namespace isolation.

bash

# Configuration example: mount SMB share over TCP instead of SMB Direct (RDMA)
# Remove the 'rdma' option from /etc/fstab entries or mount commands

# Example fstab entry forcing TCP transport
//server/share /mnt/share cifs credentials=/etc/smb-creds,vers=3.1.1,nordma 0 0

# Verify no active SMB Direct sessions
cat /proc/fs/cifs/DebugData | grep -i smbd