Linux Kernel CVE-2026-31536

Requires ksmbd (Linux kernel SMB server) to be loaded and actively serving SMB shares with SMB Direct RDMA support explicitly enabled, which is a non-default configuration requiring RDMA-capable network hardware (InfiniBand or RoCE adapters) and corresponding ksmbd configuration directives. Standard Linux distributions ship ksmbd disabled by default, and even when enabled, SMB Direct requires additional rdma_enabled=yes configuration and functional RDMA network stack. Limits to exploitation: while the CVSS vector indicates AV:N/AC:L/PR:N (remote, low complexity, no authentication), the attack surface is constrained to environments with specialized high-performance networking deployments. Systems using standard Samba (userspace smbd) instead of kernel ksmbd are not vulnerable. Systems with ksmbd enabled but without RDMA hardware or configuration are not vulnerable. The vulnerability is also limited to architectures and kernel builds where ksmbd module is compiled and loaded, typically x86_64 and ARM64 server platforms in enterprise storage or HPC environments.

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates a remotely exploitable vulnerability with low attack complexity requiring no authentication or user interaction, yielding the maximum base score of 9.8. However, real-world risk is significantly lower than this score suggests due to deployment-specific limiting factors. The EPSS score of 0.02% (4th percentile) indicates very low observed exploitation probability in the wild, likely because SMB Direct (RDMA) is a specialized feature primarily deployed in high-performance computing clusters and enterprise storage environments rather than general-purpose servers. The vulnerability requires the target system to have ksmbd (kernel SMB server) enabled with SMB Direct RDMA support configured, which is non-default in most Linux distributions. Standard Samba (userspace SMB server) deployments are not affected. While the CVSS score correctly reflects the theoretical severity of remote unauthenticated code execution, the practical attack surface is limited to organizations explicitly using Linux kernel SMB server with RDMA networking hardware. No KEV listing or public POC is identified, suggesting this remains a theoretical risk rather than an actively targeted vulnerability. Priority should be high for environments running ksmbd with RDMA, but lower for standard Linux server deployments. The availability of vendor patches for all affected stable kernel branches (6.18.11, 6.19.1, 7.0) enables straightforward remediation for at-risk systems.

An unauthenticated remote attacker identifies a Linux server with ksmbd SMB Direct enabled by scanning for RDMA-capable SMB services on TCP port 445. The attacker establishes an SMB Direct connection and initiates a series of batched RDMA send operations, then deliberately triggers a connection disruption (such as sending malformed RDMA frames or abruptly closing the connection) while send operations are queued. This forces the kernel to signal completions for all pending requests including those without IB_SEND_SIGNALED flags. The premature freeing of request structures creates a use-after-free condition, which the attacker exploits by carefully timing subsequent SMB requests to reallocate the freed memory with attacker-controlled data. By manipulating the freed memory contents, the attacker achieves arbitrary code execution in kernel context, gaining full root-level control of the target system. No public POC exists for this specific vulnerability at time of analysis.