In the Linux kernel, the following vulnerability has been resolved:
smb: client: make use of smbdirect_socket.recv_io.credits.available
The logic off managing recv credits by counting posted recv_io and
granted credits is racy.
That's because the peer might already consumed a credit,
but between receiving the incoming recv at the hardware
and processing the completion in the 'recv_done' functions
we likely have a window where we grant credits, which
don't really exist.
So we better have a decicated counter for the
available credits, which will be incremented
when we posted new recv buffers and drained when
we grant the credits to the peer.
References
Configurations
Configuration 1 (hide)
|
History
28 Apr 2026, 19:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/9911b1ed187a770a43950bf51f340ad4b7beecba - Patch | |
| References | () https://git.kernel.org/stable/c/be8845ad5d6558703d20567d8702155598325db8 - Patch | |
| References | () https://git.kernel.org/stable/c/f664e6e8a81103cb45c8802a9bc7499e0902c458 - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CWE | CWE-367 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
| First Time |
Linux
Linux linux Kernel |
24 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-24 15:16
Updated : 2026-04-28 19:14
NVD link : CVE-2026-31535
Mitre link : CVE-2026-31535
CVE.ORG link : CVE-2026-31535
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition