CVE-2026-31536: smb: server: let send_done handle a completion without IB_SEND_SIGNALED
In the Linux kernel, the following vulnerability has been resolved:
smb: server: let senddone handle a completion without IBSENDSIGNALED
With smbdirectsendbatch processing we likely have requests without IBSENDSIGNALED, which will be destroyed in the final request that has IBSENDSIGNALED set.
If the connection is broken all requests are signaled even without explicit IBSENDSIGNALED.
Affected Software
Event History
Frequently Asked Questions
Which systems are in scope?
Systems running the Linux kernel SMB server code with SMB Direct send-batch processing are in scope. The issue involves completion handling for requests that do not explicitly use IB_SEND_SIGNALED.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates network reachability, low attack complexity, no required privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N).
What is the potential impact?
The supplied severity vector rates confidentiality, integrity, and availability impact as high. The vulnerability is rated critical with a 9.8 severity score.