CVE-2026-98684
Received Received - Intake

Heap Overflow in Linux Kernel SMB Client

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallocate_range() issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server reports as an unallocated hole, to force block allocation without changing file contents. This is unsafe against Windows servers. Per the Win32 documentation, FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain nonzero data and is explicitly not coherent with recently written data: "a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network file] would not necessarily return a correct list of allocated regions. To ensure coherency [...] flush the data to the file" fsx (generic/363) reproduces the resulting corruption against Windows Server 2022: a range is written, an uncached read returns the data, yet the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole hole, so the emulation overwrites live data with zeroes. A network trace confirmed the WRITE, the READ returning data and the query returning an empty range list within microseconds. Samba does not exhibit this; its query is coherent with the written data. Write back the dirty pages, drain any outstanding I/O and issue an SMB2 FLUSH to force the server to commit the data before querying the allocated ranges, so the query reflects the data actually present. With this, generic/363 passes against both Windows Server 2022 and Samba over 100000 fsx operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98684
EUVD
EUVD-2026-103938

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
Linux Linux 966a3cb7c7db786452a87afdc3b48858fc4d4d6b
Linux Linux 966a3cb7c7db786452a87afdc3b48858fc4d4d6b
Linux Linux 966a3cb7c7db786452a87afdc3b48858fc4d4d6b
Linux Linux c406bb9ece6ef63721daab106f132ff4b4234e81
Linux Linux 2f9f4a2d0e6fcf0673ed51195e06e47abe966900
Linux Linux 5e397c943424de94879830e72c95f2679e297a76
Linux Linux 5.10.50
Linux Linux 5.12.17
Linux Linux 5.13.2
Linux Linux 5.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves unsafe fallocate emulation in SMB client operations. When using mode 0 (FALLOC_FL_KEEP_SIZE) for small interior ranges, the system queries allocated ranges via FSCTL_QUERY_ALLOCATED_RANGES and zero-fills unallocated holes. This is unsafe against Windows servers because the query may not reflect recently written data, leading to data corruption. The fix ensures dirty pages are written back and flushed before querying ranges.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and may not have direct detection commands. However, you can check if your system is running a vulnerable kernel version and monitor for data corruption in SMB-mounted files. Review kernel logs for SMB-related errors or unexpected file modifications.

Impact Analysis

This vulnerability can cause data corruption when using SMB client operations on Linux systems interacting with Windows servers. It may result in live data being overwritten with zeros due to incorrect range allocation queries, leading to file corruption and potential data loss.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel filesystem issue in SMB client operations. Compliance risks would arise only if the vulnerability led to data corruption or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this issue. Avoid using SMB fallocate operations on files that require data integrity. If using Samba, ensure it is configured to handle fallocate operations safely. Monitor file systems for corruption after SMB operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98684. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart