CVE-2026-31537: smb: server: make use of smbdirect_socket.send_io.bcredits
In the Linux kernel, the following vulnerability has been resolved:
smb: server: make use of smbdirectsocket.sendio.bcredits
It turns out that our code will corrupt the stream of reassabled data transfer messages when we trigger an immendiate (empty) send.
In order to fix this we'll have a single 'batch' credit per connection. And code getting that credit is free to use as much messages until remaininglength reaches 0, then the batch credit it given back and the next logical send can happen.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the expected security impact?
The reported impact is high availability impact, while confidentiality and integrity impact are rated none. The flaw can corrupt the stream of reassembled data-transfer messages when an immediate empty send is triggered.
What remediation is available?
A patch is available. The fix uses a single batch credit per connection so a logical send retains the credit until its remaining length reaches zero, preventing concurrent logical sends from corrupting the reassembled stream.