CVE-2026-31536: Linux Kernel DOS Vulnerability

CVE-2026-31536 Overview

CVE-2026-31536 is a critical vulnerability in the Linux kernel's SMB server implementation, specifically within the SMBDirect (SMB over RDMA) send completion handling mechanism. The flaw exists in how the send_done function processes completion events for InfiniBand (IB) send requests that lack the IB_SEND_SIGNALED flag.

During smbdirect_send_batch processing, the kernel batches multiple SMB requests where intermediate requests typically do not have IB_SEND_SIGNALED set, relying on the final request with this flag to handle cleanup. However, when a connection is unexpectedly broken, all pending requests receive completion signals regardless of whether they had IB_SEND_SIGNALED explicitly set. This creates a condition where the completion handler may improperly access or destroy request structures, leading to potential memory corruption or system instability.

Critical Impact
This vulnerability is network-accessible and can be exploited without authentication or user interaction, potentially allowing remote attackers to compromise confidentiality, integrity, and availability of affected Linux systems running SMB server with RDMA support.

Affected Products

Linux Kernel (SMB server component with SMBDirect/RDMA support)
Systems running ksmbd (in-kernel SMB3 server) with RDMA enabled
Enterprise storage and file servers utilizing SMB over RDMA

Discovery Timeline

2026-04-24 - CVE CVE-2026-31536 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31536

Vulnerability Analysis

This vulnerability stems from improper handling of InfiniBand send completion events in the Linux kernel's SMB Direct implementation. The SMBDirect protocol enables SMB3 file sharing over RDMA (Remote Direct Memory Access), providing high-throughput, low-latency storage access commonly used in enterprise environments.

The core issue lies in the batching mechanism used by smbdirect_send_batch. When processing multiple SMB requests, the implementation optimizes performance by setting IB_SEND_SIGNALED only on the final request in a batch, expecting that successful completion of the final request implies successful completion of all preceding requests. The preceding requests are then destroyed as part of the final request's completion handling.

However, when a network connection is severed or otherwise disrupted, the InfiniBand subsystem generates completion events for all pending work requests, including those that did not have IB_SEND_SIGNALED set. The send_done completion handler was not designed to gracefully handle these unexpected completion events, leading to potential double-free conditions or use-after-free scenarios when the completion handler attempts to process requests that may have already been destroyed or are in an inconsistent state.

Root Cause

The root cause is a logic flaw in the SMBDirect completion handling code that failed to account for the edge case where connection failures cause all pending requests to be signaled, regardless of their IB_SEND_SIGNALED flag status. The completion handler assumed that only explicitly signaled requests would trigger completion callbacks, leading to improper resource management during error conditions.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker could potentially:

Establish an SMB Direct connection to a vulnerable Linux server
Initiate SMB operations that trigger batched send requests
Abruptly terminate the connection during request processing
The unexpected termination causes all pending requests to be signaled simultaneously
The completion handler processes requests in an unintended order, leading to memory corruption

The attack does not require any privileges on the target system and can be triggered remotely against any Linux system running the in-kernel SMB server (ksmbd) with RDMA support enabled.

Detection Methods for CVE-2026-31536

Indicators of Compromise

Kernel crash dumps or panic messages referencing smbdirect, send_done, or RDMA completion handlers
Unexpected system reboots on servers running ksmbd with RDMA enabled
Memory corruption errors in kernel logs related to SMB or InfiniBand subsystems
Abnormal SMB connection patterns with rapid connect/disconnect cycles

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for errors related to SMBDirect or RDMA completion handling
Deploy intrusion detection rules to identify abnormal SMB Direct connection patterns
Use kernel tracing tools (ftrace, eBPF) to monitor send_done completion handler invocations
Implement network monitoring to detect unusual SMB traffic patterns targeting RDMA-enabled ports

Monitoring Recommendations

Enable verbose logging for ksmbd and RDMA subsystems on affected servers
Configure crash dump collection to preserve evidence for forensic analysis
Monitor system stability metrics for SMB servers using RDMA
Set up alerts for unexpected InfiniBand connection errors or completions

How to Mitigate CVE-2026-31536

Immediate Actions Required

Apply the official kernel patches immediately to all affected Linux systems
If immediate patching is not possible, consider temporarily disabling SMBDirect/RDMA for ksmbd
Restrict network access to SMB services to trusted networks only
Monitor affected systems for signs of exploitation attempts

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix modifies the send_done completion handler to properly handle completion events for requests that were not explicitly signaled, preventing resource management issues during connection failures.

Official patches are available through the following kernel git commits:

System administrators should update to patched kernel versions from their Linux distribution or compile from upstream sources containing these fixes.

Workarounds

Disable SMBDirect (SMB over RDMA) if not required for operations by removing or blacklisting the ksmbd RDMA transport modules
Implement network segmentation to restrict SMB access to trusted internal networks only
Use traditional SMB over TCP instead of RDMA until patches can be applied
Consider temporarily disabling the in-kernel SMB server (ksmbd) and using Samba userspace implementation as an alternative

bash

# Disable ksmbd module if not needed
sudo modprobe -r ksmbd

# Blacklist the module to prevent automatic loading
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/disable-ksmbd.conf

# Alternatively, configure firewall to restrict SMB access
sudo iptables -A INPUT -p tcp --dport 445 -s ! 10.0.0.0/8 -j DROP