This vulnerability exists in the Linux kernel SMB client’s fallocate implementation. When the client receives an allocated range from the server that starts before the current fallocate offset, it incorrectly advances over the whole range and skips a hole that should have been zero‑filled. The unwritten hole then leads to write failures later with ENOSPC, which can cause app crashes or denial of service by preventing normal file growth.

All Linux kernels that include the SMB client module are potentially affected. No specific version ranges are listed; any distribution using an unpatched kernel should update to a version that incorporates the repository commit shown in the references.

The CVSS score is 9.8 and the EPSS score is < 1%, and the flaw is not in CISA’s KEV catalog. Based on the description, an attacker can trigger the issue by sending a specially crafted SMB response with an overlapping allocated range. The client will then skip the hole, after which a subsequent write can fail. Because the trigger is a server‑side message, the vulnerability is potentially exploitable in a controlled environment and could cause denial of service or data integrity problems.