---
id: CVE-2026-31535
title: 'smb: client: make use of smbdirect_socket.recv_io.credits.available'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: make use of smbdirect_socket.recv_io.credits.available

  The logic off managing recv credits by counting posted recv_io and
  granted credits is racy.

  That's…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5fb9b459b3686e366640edd4e62805ef7b4de927 <
    f664e6e8a81103cb45c8802a9bc7499e0902c458
  - >-
    Linux >= 5fb9b459b3686e366640edd4e62805ef7b4de927 <
    be8845ad5d6558703d20567d8702155598325db8
  - >-
    Linux >= 5fb9b459b3686e366640edd4e62805ef7b4de927 <
    9911b1ed187a770a43950bf51f340ad4b7beecba
  - Linux 6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:37:58.578551Z'
published: '2026-04-24'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:45:06.795Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31535'
references:
  - url: 'https://git.kernel.org/stable/c/f664e6e8a81103cb45c8802a9bc7499e0902c458'
  - url: 'https://git.kernel.org/stable/c/be8845ad5d6558703d20567d8702155598325db8'
  - url: 'https://git.kernel.org/stable/c/9911b1ed187a770a43950bf51f340ad4b7beecba'
tags:
  - cve.org
epss: 0.00088
epssPercentile: 0.00355
ingestedAt: '2026-11-05T23:41:31.972Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: make use of smbdirect_socket.recv_io.credits.available

The logic off managing recv credits by counting posted recv_io and
granted credits is racy.

That's because the peer might already consumed a credit,
but between receiving the incoming recv at the hardware
and processing the completion in the 'recv_done' functions
we likely have a window where we grant credits, which
don't really exist.

So we better have a decicated counter for the
available credits, which will be incremented
when we posted new recv buffers and drained when
we grant the credits to the peer.

## Affected

- `Linux >= 5fb9b459b3686e366640edd4e62805ef7b4de927 < f664e6e8a81103cb45c8802a9bc7499e0902c458`
- `Linux >= 5fb9b459b3686e366640edd4e62805ef7b4de927 < be8845ad5d6558703d20567d8702155598325db8`
- `Linux >= 5fb9b459b3686e366640edd4e62805ef7b4de927 < 9911b1ed187a770a43950bf51f340ad4b7beecba`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.