CVE-2026-31536: Linux Kernel

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: smb: server: let send_done handle a completion without IB_SEND_SIGNALED With smbdirect_send_batch processing we likely have requests without IB_SEND_SIGNALED, which will be destroyed in the final request that has IB_SEND_SIGNALED set. If the connection is broken all requests are signaled even without explicit IB_SEND_SIGNALED.

Affected products

• Linux Linux Kernel: from 5.15, before 6.18.11 (fixed in 6.18.11); from 6.19, before 6.19.1 (fixed in 6.19.1)

Published 2026-04-24. Last modified 2026-06-17.