{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"f664e6e8a81103cb45c8802a9bc7499e0902c458","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"be8845ad5d6558703d20567d8702155598325db8","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"9911b1ed187a770a43950bf51f340ad4b7beecba","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-31535","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer.","epss":{"date":"2026-11-05","percentile":0.00359,"score":0.00088},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793915106795,"publishedAt":1777041023540,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f664e6e8a81103cb45c8802a9bc7499e0902c458"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/be8845ad5d6558703d20567d8702155598325db8"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/9911b1ed187a770a43950bf51f340ad4b7beecba"}],"remediation":[],"revision":"fdd184063840a33869c3c5dbd46868cc1d73279da3443a9ba7c18d939cba390d","sources":[{"modifiedAt":1793915106795,"name":"CNA: Linux","retrievedAt":1793917089464,"url":"https://www.cve.org/CVERecord?id=CVE-2026-31535"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793917102560,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-31535"}],"ssvc":{"assessedAt":1793914678578,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"smb: client: make use of smbdirect_socket.recv_io.credits.available","updatedAt":1793917102560}