Bug 2461481 (CVE-2026-31538)

Summary: CVE-2026-31538 kernel: smb: server: make use of smbdirect_socket.recv_io.credits.available
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Server Message Block (SMB) direct server. A race condition exists in the logic responsible for managing receive credits. This occurs because the system's method of counting posted receive input/output (recv_io) and granted credits is susceptible to timing issues. Consequently, the server may grant credits that have already been consumed by the peer, leading to incorrect credit management and potential instability.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-24 15:04:02 UTC 
In the Linux kernel, the following vulnerability has been resolved:

smb: server: make use of smbdirect_socket.recv_io.credits.available

The logic off managing recv credits by counting posted recv_io and
granted credits is racy.

That's because the peer might already consumed a credit,
but between receiving the incoming recv at the hardware
and processing the completion in the 'recv_done' functions
we likely have a window where we grant credits, which
don't really exist.

So we better have a decicated counter for the
available credits, which will be incremented
when we posted new recv buffers and drained when
we grant the credits to the peer.

This fixes regression Namjae reported with
the 6.18 release.
Comment 1 Keith Grant 2026-04-24 16:32:23 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026042434-CVE-2026-31538-a6f7@gregkh/T