ACK: [SRU][Q/N/J][PATCH 0/3] CVE-2026-31536

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/23/26 12:19, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-31536
>
> [ Impact ]
>
> The ksmbd server's SMB Direct (RDMA) send completion handler did not correctly
> handle send completions for requests that lacked the IB_SEND_SIGNALED flag.
> With smbdirect_send_batch processing, multiple requests are queued without
> IB_SEND_SIGNALED and are intended to be destroyed by the final signaled
> request, but when a connection is broken all requests are signaled regardless.
> Without proper handling, send_done could mishandle these unsignaled
> completions, leading to memory corruption or a denial of service.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
> noble: backported with AI-assisted adaptation
> jammy: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> An incorrect fix in the ksmbd SMB Direct send completion path could cause use-
> after-free conditions, dropped RDMA send completions, or hangs on connection
> teardown, affecting clients connecting to the in-kernel SMB server over RDMA
> transports.
>