Description
In the Linux kernel, the following vulnerability has been resolved:

smb: client: flush and commit data before querying allocated ranges

The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior
ranges in smb3_simple_fallocate_range() issues
FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server
reports as an unallocated hole, to force block allocation without
changing file contents.

This is unsafe against Windows servers. Per the Win32 documentation,
FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain
nonzero data and is explicitly not coherent with recently written data:

"a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network
file] would not necessarily return a correct list of allocated
regions. To ensure coherency [...] flush the data to the file"

fsx (generic/363) reproduces the resulting corruption against Windows
Server 2022: a range is written, an uncached read returns the data, yet
the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole
hole, so the emulation overwrites live data with zeroes. A network trace
confirmed the WRITE, the READ returning data and the query returning an
empty range list within microseconds. Samba does not exhibit this; its
query is coherent with the written data.

Write back the dirty pages, drain any outstanding I/O and issue an SMB2
FLUSH to force the server to commit the data before querying the
allocated ranges, so the query reflects the data actually present.

With this, generic/363 passes against both Windows Server 2022 and Samba
over 100000 fsx operations.
Published: 2026-10-18
Score: 2.5 Low
EPSS: < 1% Very Low
KEV: No
Impact: Data Corruption
Action: Patch Kernel
AI Analysis

Impact

The Linux kernel SMB client mishandles the FALLOC_FL_KEEP_SIZE flag for small interior ranges in smb3_simple_fallocate_range(). Before querying the server for allocated ranges, it fails to force the Windows server to commit written data. The client then zero‑fills any sub‑range reported as an unallocated hole, overwriting live data. This flaw triggers data loss on SMB shares and is an improper handling of memory allocation ranges (CWE-820).

Affected Systems

Linux kernels that have not yet incorporated the SMB client patch are affected. Any distribution using the generic Linux kernel is at risk, especially when accessing Windows 2022 files via SMB3. The vulnerability resides in the kernel’s SMB client code and is limited to environments that use SMB3 file operations.

Risk and Exploitability

Based on the description, it is inferred that the attack vector requires an attacker to write data to a Windows file via SMB3 and then access that file or query allocated ranges before the Windows server has committed the data. This scenario demands specific timing and SMB3 access, indicating a low probability of exploitation with an EPSS score of < 1%. The vulnerability is not listed in the CISA KEV catalog, and its CVSS score is 2.5. Consequently, the data corruption risk manifests when the Linux SMB client zero‑fills a range that the server reports as a hole but has already been written to.

Generated by OpenCVE AI on October 23, 2026 at 06:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the SMB client fix for SMB3 fallocate handling, which forces an SMB2 FLUSH before querying allocated ranges.
  • If a kernel update cannot be applied immediately, use an SMB client configuration or mounting option that avoids the buggy fallocate emulation, such as disabling simplified SMB3 fallocate mode or switching to a client that performs proper flush sequencing.
  • Verify that the system performs an SMB2 FLUSH after each write before querying allocated ranges; if not, enforce this by updating the SMB client or adjusting application behavior to explicitly flush.

Generated by OpenCVE AI on October 23, 2026 at 06:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-750

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-820
References
Metrics threat_severity

None

 cvssV3_1

{'score': 2.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'}

threat_severity

Low

Sun, 18 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-750

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallocate_range() issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server reports as an unallocated hole, to force block allocation without changing file contents. This is unsafe against Windows servers. Per the Win32 documentation, FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain nonzero data and is explicitly not coherent with recently written data: "a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network file] would not necessarily return a correct list of allocated regions. To ensure coherency [...] flush the data to the file" fsx (generic/363) reproduces the resulting corruption against Windows Server 2022: a range is written, an uncached read returns the data, yet the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole hole, so the emulation overwrites live data with zeroes. A network trace confirmed the WRITE, the READ returning data and the query returning an empty range list within microseconds. Samba does not exhibit this; its query is coherent with the written data. Write back the dirty pages, drain any outstanding I/O and issue an SMB2 FLUSH to force the server to commit the data before querying the allocated ranges, so the query reflects the data actually present. With this, generic/363 passes against both Windows Server 2022 and Samba over 100000 fsx operations.
Title smb: client: flush and commit data before querying allocated ranges
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:23:54.479Z

Reserved: 2026-09-25T10:25:14.364Z

Link: CVE-2026-98684

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:21.770

Modified: 2026-10-19T10:19:32.823

Link: CVE-2026-98684

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98684 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T06:15:13Z

Weaknesses