[SRU][Q/N/J][PATCH 0/3] CVE-2026-31536

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-31536

[ Impact ]

The ksmbd server's SMB Direct (RDMA) send completion handler did not correctly
handle send completions for requests that lacked the IB_SEND_SIGNALED flag.
With smbdirect_send_batch processing, multiple requests are queued without
IB_SEND_SIGNALED and are intended to be destroyed by the final signaled
request, but when a connection is broken all requests are signaled regardless.
Without proper handling, send_done could mishandle these unsignaled
completions, leading to memory corruption or a denial of service.

[ Fix ]

questing: backported with AI-assisted adaptation
noble: backported with AI-assisted adaptation
jammy: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

An incorrect fix in the ksmbd SMB Direct send completion path could cause use-
after-free conditions, dropped RDMA send completions, or hangs on connection
teardown, affecting clients connecting to the in-kernel SMB server over RDMA
transports.