Linux Kernel CVE-2026-31535

This vulnerability exists in the SMB client implementation of the Linux kernel, specifically in the SMBDirect (SMB over RDMA/TCP) socket credit management mechanism. SMB credit systems regulate data flow between client and server by limiting concurrent operations; the vulnerability (CWE-367, race condition) occurs in the logic that manages 'recv credits' - the number of recv buffers available to receive data. The code incorrectly tracks credits by counting posted recv_io operations and granted credits, creating a time-of-check-time-of-use (TOCTOU) window. Between when incoming data arrives at the hardware level and when the completion handler processes it, the kernel may grant credits to the peer that don't actually exist because the hardware has consumed them but the kernel hasn't updated its accounting. The fix introduces a dedicated 'smbdirect_socket.recv_io.credits.available' counter that increments only when new recv buffers are posted and decrements when credits are actually granted, eliminating the race condition.