smb: client: flush and commit data before querying allocated ranges
Summary
| CVE | CVE-2026-98684 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-10-18 16:17:21 UTC |
|---|
| Updated | 2026-10-19 10:19:32 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
smb: client: flush and commit data before querying allocated ranges
The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior
ranges in smb3_simple_fallocate_range() issues
FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server
reports as an unallocated hole, to force block allocation without
changing file contents.
This is unsafe against Windows servers. Per the Win32 documentation,
FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain
nonzero data and is explicitly not coherent with recently written data:
"a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network
file] would not necessarily return a correct list of allocated
regions. To ensure coherency [...] flush the data to the file"
fsx (generic/363) reproduces the resulting corruption against Windows
Server 2022: a range is written, an uncached read returns the data, yet
the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole
hole, so the emulation overwrites live data with zeroes. A network trace
confirmed the WRITE, the READ returning data and the query returning an
empty range list within microseconds. Samba does not exhibit this; its
query is coherent with the written data.
Write back the dirty pages, drain any outstanding I/O and issue an SMB2
FLUSH to force the server to commit the data before querying the
allocated ranges, so the query reflects the data actually present.
With this, generic/363 passes against both Windows Server 2022 and Samba
over 100000 fsx operations. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 966a3cb7c7db786452a87afdc3b48858fc4d4d6b f82242fe3109a3ef72f429540b5bdde08fbfb0e4 git |
Not specified |
| CNA |
Linux |
Linux |
affected 966a3cb7c7db786452a87afdc3b48858fc4d4d6b bf84e44ff0ed802778eafd7ecb623635379cb506 git |
Not specified |
| CNA |
Linux |
Linux |
affected 966a3cb7c7db786452a87afdc3b48858fc4d4d6b aa994489bd835547c191827acc460192e147032d git |
Not specified |
| CNA |
Linux |
Linux |
affected c406bb9ece6ef63721daab106f132ff4b4234e81 git |
Not specified |
| CNA |
Linux |
Linux |
affected 2f9f4a2d0e6fcf0673ed51195e06e47abe966900 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5e397c943424de94879830e72c95f2679e297a76 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5.10.50 5.11 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.12.17 5.13 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.13.2 5.14 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 5.14 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.14 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.56 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.10 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/aa994489bd835547c191827acc460192e147032d |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/f82242fe3109a3ef72f429540b5bdde08fbfb0e4 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/bf84e44ff0ed802778eafd7ecb623635379cb506 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.