Linux Kernel CVE-2026-31536

This vulnerability affects the Linux kernel's ksmbd module, specifically the SMB Direct (SMBDirect) implementation which uses RDMA (Remote Direct Memory Access) over InfiniBand for high-performance SMB file sharing. The issue occurs in the send_done completion handler when processing batched RDMA send requests. In RDMA operations, IB_SEND_SIGNALED is a flag that requests completion notifications for send operations. The ksmbd implementation batches multiple send operations where only the final request carries IB_SEND_SIGNALED for efficiency. However, when a connection breaks unexpectedly, the RDMA layer signals completions for all pending requests regardless of the IB_SEND_SIGNALED flag. The vulnerable code path fails to handle this scenario correctly, leading to premature destruction of request structures that were expected to be freed only with the final signaled completion. This creates a classic use-after-free condition where memory is accessed after being deallocated. The affected code paths are in the SMB server's RDMA transport layer, which is only active when SMB Direct is configured and enabled. The CPE strings indicate broad kernel version exposure from the initial Git commit 1da177e4c3f4 (kernel 2.6.12-rc2, 2005) through current versions, though SMBDirect support was added much later, making the practical exposure window narrower than CPE suggests.