LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31536: smb: server: let send_done handle a completion without IB_SEND_SIGNALED

In the Linux kernel, the following vulnerability has been resolved: smb: server: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_send_batch processing we likely have requests without IB_SEND_SIGNALED, which will be destroyed in the final request that has IB_SEND_SIGNALED set. If the connection is broken all requests are signaled even without explicit IB_SEND_SIGNALED.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux kernel SMB server flaw can mishandle completed network-send requests when an SMB Direct connection breaks. The supplied record assigns CVSS 9.8, indicating possible remote compromise without authentication or user interaction. However, the description does not explain how the bug produces confidentiality, integrity, or availability impact, so real-world severity remains insufficiently substantiated.

Executive priority

Prioritize immediate exposure assessment because the assigned score is critical and the stated attack vector is remote. Accelerate patching for internet-facing or broadly reachable SMB Direct systems. Avoid claiming confirmed compromise risk until vendors clarify affected packages and the underlying impact; there is no supplied evidence of active exploitation.

Technical view

During SMB Direct batched sends, requests lacking IB_SEND_SIGNALED are normally released with the final signaled request. A broken connection instead signals every request, requiring send_done to safely handle unexpected completions. The sources identify stable-kernel fixes but do not specify the resulting memory-safety condition, reachable attack sequence, or exact impact mechanism.

Likely exposure

Potential exposure concerns affected Linux kernels using the kernel SMB server with SMB Direct/RDMA batched sending. The supplied affected-version data lists 5.15, 0, 6.18.11, 6.19.1, and 7.0, but its unusual formatting prevents reliable interpretation. Confirm exposure against distribution advisories and fixed-kernel mappings.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public proof of concept. Although its CVSS vector describes network-accessible, unauthenticated exploitation, the technical description only documents completion handling after a broken connection. Treat exploitability as unconfirmed pending stronger vendor or researcher evidence.

Researcher notes

Important gaps remain: no CWE, crash trace, vulnerable function details, demonstrated security consequence, or public exploit evidence is supplied. Review the referenced stable changes to establish the precise failure mode and fixed branch ancestry. Treat the listed versions cautiously because the data includes an unexplained "0" and lacks explicit distribution-package mappings.

Mitigation direction

  • Update to a vendor-supported kernel release incorporating the referenced stable fixes.
  • Check Linux distribution advisories for corrected package versions and backport status.
  • Restrict untrusted network access to SMB services while exposure is assessed.
  • Disable SMB Direct where operationally acceptable until affected systems are remediated.

Validation and detection

  • Inventory Linux hosts providing kernel SMB services and record exact kernel package versions.
  • Determine whether SMB Direct/RDMA is enabled and reachable from untrusted networks.
  • Map installed kernels to distribution advisories or the referenced stable commits.
  • After updating, verify the running kernel matches the installed corrected package.
  • Monitor kernel and SMB service logs for crashes or connection-related anomalies.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31536 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-31536Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0626e6641f6b467447c81dd7678a69c66f7746cf, 0626e6641f6b467447c81dd7678a69c66f7746cf, 0626e6641f6b467447c81dd7678a69c66f7746cfunaffected
LinuxLinux5.15, 0, 6.18.11, 6.19.1, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.