CVE-2026-98684 smb: client: flush and commit data before querying allocated ranges
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-98684?
CVE-2026-98684 is a vulnerability in Linux, published on 18 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: flush and commit data before querying allocated ranges
The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallocate_range() issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server reports as an unallocated hole, to force block allocation without changing file contents.
This is unsafe against Windows servers. Per the Win32 documentation, FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain nonzero data and is explicitly not coherent with recently written data:
"a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network file] would not necessarily return a correct list of allocated regions. To ensure coherency [...] flush the data to the file"
fsx (generic/363) reproduces the resulting corruption against Windows Server 2022: a range is written, an uncached read returns the data, yet the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole hole, so the emulation overwrites live data with zeroes. A network trace confirmed the WRITE, the READ returning data and the query returning an empty range list within microseconds. Samba does not exhibit this; its query is coherent with the written data.
Write back the dirty pages, drain any outstanding I/O and issue an SMB2 FLUSH to force the server to commit the data before querying the allocated ranges, so the query reflects the data actually present.
With this, generic/363 passes against both Windows Server 2022 and Samba over 100000 fsx operations.
Which versions are affected by CVE-2026-98684?
How do I fix CVE-2026-98684?
Upgrade to a fixed version.
Is CVE-2026-98684 being exploited?
There is no known exploitation of CVE-2026-98684 in the wild and no public exploit code.
Sources
Also known as AZL-110462, BELL-CVE-2026-98684, DEBIAN-CVE-2026-98684, GHSA-6247-f99h-hr72, UBUNTU-CVE-2026-98684.