CVE-2026-31539: Linux Kernel Race Condition Vulnerability

CVE-2026-31539 Overview

CVE-2026-31539 is a race condition in the Linux kernel's SMB Direct (smbdirect) implementation. The flaw affects how the kernel tracks receive credits between the SMB client and its remote peer. Because credit accounting relied on counting posted recv_io buffers and granted credits, a timing window allowed the kernel to grant credits that did not actually exist on the wire. A remote peer interacting with an affected SMB Direct endpoint can trigger the race, resulting in a high availability impact on the target host.

Critical Impact
A network-adjacent attacker can exploit the credit accounting race in smbdirect to cause denial of service against the Linux kernel SMB Direct stack without authentication or user interaction.

Affected Products

Linux kernel branches containing the smbdirect (SMB over RDMA) client code prior to the fix
Distributions shipping affected stable kernel trees referenced by commits 6e3c5052, e811e60e, and f9999687
Systems mounting CIFS/SMB shares over RDMA transports

Discovery Timeline

2026-04-24 - CVE-2026-31539 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31539

Vulnerability Analysis

The vulnerability resides in the receive credit management logic of the kernel's smbdirect transport. SMB Direct uses a credit-based flow control scheme where each side advertises how many receive buffers it has posted. The peer must not send more messages than the credits it has been granted. The pre-patch implementation derived the available credit count by counting posted recv_io structures combined with the number of credits already granted.

This derivation is racy. Between the moment hardware receives an incoming message and the moment the recv_done completion handler runs, the peer has already consumed a credit on its side. During that interval, the kernel can recompute the credit total and grant credits to the peer that do not correspond to real, unconsumed buffers. The mismatch corrupts the protocol's flow control state and can lead to buffer accounting errors that crash the transport.

Root Cause

The root cause is the absence of a dedicated, atomically maintained counter for available receive credits. State was inferred from two independent variables (posted receives and granted credits) updated at different points in the receive pipeline. The fix introduces smbdirect_socket.recv_io.credits.available, a single counter incremented when new receive buffers are posted and decremented when credits are granted to the peer. This eliminates the inference and the associated TOCTOU window.

Attack Vector

Exploitation requires network reachability to a Linux host that has established an SMB Direct (SMB over RDMA) session. No authentication or user interaction is required once the transport is active. By manipulating the timing and volume of SMB Direct traffic against the host, a remote peer can race the credit recomputation against in-flight receive completions and force the kernel into an inconsistent credit state, producing a denial-of-service condition.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Verified code-level details are documented in the upstream stable commits; see the Kernel Git Commit 6e3c5052, Kernel Git Commit e811e60e, and Kernel Git Commit f9999687 for the patch.

Detection Methods for CVE-2026-31539

Indicators of Compromise

Unexpected kernel oops or panic messages referencing smbdirect, smbd_recv, or recv_done in dmesg and /var/log/kern.log.
Sudden disconnects or repeated re-establishment of SMB Direct sessions against a Linux client or server.
Anomalous RDMA traffic patterns directed at SMB Direct endpoints (typically TCP/RDMA port 5445).

Detection Strategies

Inventory hosts that load the cifs module with SMB Direct enabled and compare running kernel versions against patched stable releases.
Alert on kernel ring buffer entries containing smbdirect warnings or credit-related stack traces.
Monitor for repeated SMB Direct transport resets correlated with traffic from a single remote peer.

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and create rules for smbdirect fault signatures.
Track availability metrics for SMB file services and trigger alerts on repeated transport restarts.
Capture flow records for RDMA-capable interfaces to identify unusual peers initiating SMB Direct sessions.

How to Mitigate CVE-2026-31539

Immediate Actions Required

Identify kernels exposing the smbdirect transport and prioritize them for patching to a fixed stable release.
Restrict network reachability to SMB Direct endpoints using host firewalls and segmentation, allowing only trusted RDMA peers.
Disable SMB Direct on hosts that do not require RDMA-accelerated file sharing.

Patch Information

The fix introduces the smbdirect_socket.recv_io.credits.available counter to replace the racy inference of available credits. Apply the patches referenced in the upstream stable commits 6e3c5052f9686192e178806e017b7377155f4bab, e811e60e1cc79923c4388146eb1fa26a7482731e, and f99996870222b598914a1f49d7375dc23752c237, or upgrade to a distribution kernel that incorporates these commits.

Workarounds

Mount SMB shares using TCP transport instead of RDMA where feasible, avoiding smbdirect code paths.
Unload the cifs module on hosts that do not act as SMB clients to remove the attack surface entirely.
Limit which network interfaces accept RDMA SMB Direct connections through subnet manager and firewall policy.

bash

# Check current kernel version and whether cifs/smbdirect is in use
uname -r
lsmod | grep -E 'cifs|smbdirect|rdma'

# Verify mounted SMB shares and their transport
mount -t cifs
cat /proc/fs/cifs/DebugData | grep -i rdma

# Disable SMB Direct for new mounts (omit the rdma option)
# Example: mount without RDMA acceleration
mount -t cifs -o vers=3.1.1,username=user //server/share /mnt/share