Description
In the Linux kernel, the following vulnerability has been resolved:

smb: client: flush and commit data before querying allocated ranges

The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior
ranges in smb3_simple_fallocate_range() issues
FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server
reports as an unallocated hole, to force block allocation without
changing file contents.

This is unsafe against Windows servers. Per the Win32 documentation,
FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain
nonzero data and is explicitly not coherent with recently written data:

"a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network
file] would not necessarily return a correct list of allocated
regions. To ensure coherency [...] flush the data to the file"

fsx (generic/363) reproduces the resulting corruption against Windows
Server 2022: a range is written, an uncached read returns the data, yet
the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole
hole, so the emulation overwrites live data with zeroes. A network trace
confirmed the WRITE, the READ returning data and the query returning an
empty range list within microseconds. Samba does not exhibit this; its
query is coherent with the written data.

Write back the dirty pages, drain any outstanding I/O and issue an SMB2
FLUSH to force the server to commit the data before querying the
allocated ranges, so the query reflects the data actually present.

With this, generic/363 passes against both Windows Server 2022 and Samba
over 100000 fsx operations.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Data Corruption
Action: Patch Kernel
AI Analysis

Impact

The Linux kernel SMB client incorrectly handles the FALLOC_FL_KEEP_SIZE flag for small interior ranges in smb3_simple_fallocate_range(). Before querying the server for allocated ranges, it fails to force the Windows server to commit the data, so a subsequent FSCTL_QUERY_ALLOCATED_RANGES may return an empty range list even after a write. The client then zero‑fills any unallocated hole reported, overwriting live data. This flaw can cause data loss on SMB shares and results from improper operation sequencing (CWE-750).

Affected Systems

Linux kernels that have not yet received the SMB client patch are affected. Any distribution using the generic Linux kernel is at risk, especially when accessing Windows 2022 files via SMB3. The vulnerability resides in the kernel’s SMB client code and is limited to environments that use SMB3 file operations.

Risk and Exploitability

The EPSS score is not available and the issue is not listed in the CISA KEV catalog, but it can lead to loss of file contents on Windows servers accessed through the affected Linux kernel. Exploitation would require writing data to a Windows share and then accessing it via the SMB client before the server has committed the data, a scenario that demands specific SMB3 access and timing. Updating to the patched kernel removes the risk; otherwise, mitigation hinges on ensuring a flush occurs before querying allocated ranges.

Generated by OpenCVE AI on October 18, 2026 at 18:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the SMB client fix for SMB3 fallocate handling, which forces an SMB2 FLUSH before querying allocated ranges.
  • If a kernel update cannot be applied immediately, use an SMB client configuration or mounting option that avoids the buggy fallocate emulation, such as disabling simplified SMB3 fallocate mode or switching to a client that performs proper flush sequencing.
  • Verify that the system performs an SMB2 FLUSH after each write before querying allocated ranges; if not, enforce this by updating the SMB client or adjusting application behavior to explicitly flush.

Generated by OpenCVE AI on October 18, 2026 at 18:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-750

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallocate_range() issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server reports as an unallocated hole, to force block allocation without changing file contents. This is unsafe against Windows servers. Per the Win32 documentation, FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain nonzero data and is explicitly not coherent with recently written data: "a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network file] would not necessarily return a correct list of allocated regions. To ensure coherency [...] flush the data to the file" fsx (generic/363) reproduces the resulting corruption against Windows Server 2022: a range is written, an uncached read returns the data, yet the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole hole, so the emulation overwrites live data with zeroes. A network trace confirmed the WRITE, the READ returning data and the query returning an empty range list within microseconds. Samba does not exhibit this; its query is coherent with the written data. Write back the dirty pages, drain any outstanding I/O and issue an SMB2 FLUSH to force the server to commit the data before querying the allocated ranges, so the query reflects the data actually present. With this, generic/363 passes against both Windows Server 2022 and Samba over 100000 fsx operations.
Title smb: client: flush and commit data before querying allocated ranges
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:45:52.828Z

Reserved: 2026-09-25T10:25:14.364Z

Link: CVE-2026-98684

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:21.770

Modified: 2026-10-18T16:17:21.770

Link: CVE-2026-98684

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T19:00:11Z

Weaknesses