CVE-2026-31539

{"id": "CVE-2026-31539", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31539", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:10:46.426998Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "lessThan": "e811e60e1cc79923c4388146eb1fa26a7482731e", "versionType": "git"}, {"status": "affected", "version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "lessThan": "f99996870222b598914a1f49d7375dc23752c237", "versionType": "git"}, {"status": "affected", "version": "5fb9b459b3686e366640edd4e62805ef7b4de927", "lessThan": "6e3c5052f9686192e178806e017b7377155f4bab", "versionType": "git"}], "programFiles": ["fs/smb/common/smbdirect/smbdirect_socket.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.11", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.1", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/common/smbdirect/smbdirect_socket.h"], "defaultStatus": "affected"}]}], "published": "2026-04-24T15:16:27.843", "references": [{"url": "https://git.kernel.org/stable/c/6e3c5052f9686192e178806e017b7377155f4bab", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e811e60e1cc79923c4388146eb1fa26a7482731e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f99996870222b598914a1f49d7375dc23752c237", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: smbdirect: introduce smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: smbdirect: se introduce smbdirect_socket.recv_io.credits.available\n\nLa l\u00f3gica de gestionar los cr\u00e9ditos recv contando los recv_io publicados y los cr\u00e9ditos concedidos es propensa a condiciones de carrera.\n\nEsto se debe a que el par ya podr\u00eda haber consumido un cr\u00e9dito, pero entre la recepci\u00f3n del recv entrante en el hardware y el procesamiento de la finalizaci\u00f3n en las funciones \u2019recv_done\u2019 es probable que tengamos una ventana donde concedemos cr\u00e9ditos que en realidad no existen.\n\nAs\u00ed que es mejor tener un contador dedicado para los cr\u00e9ditos disponibles, el cual ser\u00e1 incrementado cuando publiquemos nuevos b\u00faferes recv y disminuido cuando concedamos los cr\u00e9ditos al par."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D06FE45-F85F-4F59-A12C-C72C3C580DA4", "versionEndExcluding": "6.18.11", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE543C0D-A06B-414F-A403-CB1E088F261E", "versionEndExcluding": "6.19.1", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}