In the Linux kernel, the following vulnerability has been resolved:
smb: server: make use of smbdirect_socket.recv_io.credits.available
The logic off managing recv credits by counting posted recv_io and
granted credits is racy.
That's because the peer might already consumed a credit,
but between receiving the incoming recv at the hardware
and processing the completion in the 'recv_done' functions
we likely have a window where we grant credits, which
don't really exist.
So we better have a decicated counter for the
available credits, which will be incremented
when we posted new recv buffers and drained when
we grant the credits to the peer.
This fixes regression Namjae reported with
the 6.18 release.
References
Configurations
Configuration 1 (hide)
|
History
28 Apr 2026, 18:59
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other | |
| References | () https://git.kernel.org/stable/c/26ad87a2cfb8c1384620d1693a166ed87303046e - Patch | |
| References | () https://git.kernel.org/stable/c/66c082e3d4651e8629a393a9e182b01eb50fb0a3 - Patch | |
| References | () https://git.kernel.org/stable/c/809cbd31aa4f87a1b889532244c9cf30eb022385 - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| First Time |
Linux
Linux linux Kernel |
27 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
24 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-24 15:16
Updated : 2026-06-17 10:33
NVD link : CVE-2026-31538
Mitre link : CVE-2026-31538
CVE.ORG link : CVE-2026-31538
JSON object : View
Products Affected
linux
- linux_kernel
CWE