CVE-2026-31609: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31609 Overview

CVE-2026-31609 is a double-free vulnerability [CWE-415] in the Linux kernel's SMB client component. The flaw resides in the SMB Direct (RDMA) send path, where smbd_free_send_io() is called twice on the same send I/O structure. Specifically, smbd_send_batch_flush() already releases the send I/O, but the code path after smbd_post_send() moved it to the batch list and then called smbd_free_send_io() a second time.

A double-free in kernel memory can lead to heap corruption, kernel panics, or memory disclosure, and under specific allocator conditions may be leveraged for privilege escalation.

Critical Impact
The vulnerability affects systems mounting SMB shares over RDMA transports, with potential for kernel memory corruption and remote impact on confidentiality, integrity, and availability.

Affected Products

Linux Kernel (mainline) — smb/client subsystem with SMB Direct enabled
Linux distributions shipping vulnerable kernel versions prior to the fix commits
Systems using cifs.ko/smb.ko with RDMA-backed SMB connections

Discovery Timeline

2026-04-24 - CVE-2026-31609 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-31609

Vulnerability Analysis

The vulnerability is a double-free [CWE-415] in the Linux kernel SMB client's RDMA send path. When the client sends SMB Direct frames, smbd_post_send() may move a send I/O descriptor onto a batch list before triggering smbd_send_batch_flush(). The flush routine already calls smbd_free_send_io() on each descriptor in the batch. The caller then incorrectly invoked smbd_free_send_io() a second time on the same pointer, releasing memory that had already been freed.

Double-free conditions in the kernel slab allocator can corrupt freelist metadata, enabling controlled overlap of subsequent allocations. Adjacent allocations may be reallocated to attacker-influenced contexts, producing use-after-free primitives suitable for arbitrary kernel read or write.

Because the vulnerable path is reachable through SMB Direct, a remote actor controlling an SMB server or interposing on RDMA traffic can influence the timing and content of send I/O operations.

Root Cause

The root cause is a control-flow refactor in the SMB Direct send pipeline. smbd_post_send() was changed to move the send I/O descriptor onto the batch list, with smbd_send_batch_flush() taking ownership of freeing it. The original cleanup at the call site was not removed, leaving a redundant smbd_free_send_io() call after the flush. The result is two releases of the same struct smbd_send_io.

Attack Vector

Exploitation requires that the target system has an active SMB Direct (SMB over RDMA) connection. A malicious or compromised SMB server can craft a sequence of operations that drives the client through the vulnerable batch-flush path. Triggering the double-free corrupts kernel heap state, which may produce denial of service through a kernel panic or, in more targeted scenarios, escalate to kernel memory corruption.

No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability mechanism is described in the upstream commit messages referenced in the Kernel Git Commit 22b7c1c and related stable backports.

Detection Methods for CVE-2026-31609

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing smbd_free_send_io, smbd_send_batch_flush, or smbd_post_send call sites.
Slab allocator warnings such as kernel BUG at mm/slub.c or double free or corruption messages tied to the cifs/smb module.
Unexpected disconnects of SMB Direct sessions accompanied by RDMA queue-pair teardown errors.

Detection Strategies

Inventory Linux endpoints and servers running kernels prior to the patched stable releases identified in the upstream commits.
Correlate kernel ring buffer events with active SMB Direct mounts to identify hosts exposed to the vulnerable code path.
Monitor for SMB clients connecting to untrusted or newly observed SMB servers over RDMA-capable interfaces.

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized logging or SIEM platform for kernel crash analytics.
Alert on repeated SMB Direct session resets, RDMA IBV_WC_* error codes, or cifs module taints.
Track kernel package versions across the fleet and flag hosts not yet rebased onto a patched stable kernel.

How to Mitigate CVE-2026-31609

Immediate Actions Required

Update affected systems to a Linux kernel release containing the upstream fix commits 22b7c1c, 27b7c3e, a9940dc, or f9a162c.
Restrict SMB client connections to trusted servers and segmented networks until patches are deployed.
If RDMA is not required, disable SMB Direct by mounting shares without the rdma option.

Patch Information

The upstream fix removes the redundant call to smbd_free_send_io() after smbd_post_send() has handed the descriptor to the batch list. Distribution kernels should pick up the change via stable backports. Reference commits: Kernel Git Commit 22b7c1c, Kernel Git Commit 27b7c3e, Kernel Git Commit a9940dc, and Kernel Git Commit f9a162c.

Workarounds

Mount SMB shares without the rdma mount option to bypass the SMB Direct send path.
Block RDMA traffic (typically iWARP/RoCE ports) to and from untrusted SMB servers via host or network firewall policy.
Unload the cifs module on hosts that do not require SMB client functionality using modprobe -r cifs.

bash

# Configuration example
# Mount an SMB share without RDMA to avoid the vulnerable path
mount -t cifs //fileserver/share /mnt/share \
    -o username=alice,vers=3.1.1

# Verify no active SMB Direct sessions are in use
cat /proc/fs/cifs/DebugData | grep -i smbd

# Check current running kernel against fixed stable releases
uname -r