{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98684", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.364Z", "datePublished": "2026-10-18T15:45:52.828Z", "dateUpdated": "2026-10-19T09:23:54.479Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:23:54.479Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: flush and commit data before querying allocated ranges\n\nThe mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior\nranges in smb3_simple_fallocate_range() issues\nFSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server\nreports as an unallocated hole, to force block allocation without\nchanging file contents.\n\nThis is unsafe against Windows servers. Per the Win32 documentation,\nFSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain\nnonzero data and is explicitly not coherent with recently written data:\n\n \"a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network\n file] would not necessarily return a correct list of allocated\n regions. To ensure coherency [...] flush the data to the file\"\n\nfsx (generic/363) reproduces the resulting corruption against Windows\nServer 2022: a range is written, an uncached read returns the data, yet\nthe next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole\nhole, so the emulation overwrites live data with zeroes. A network trace\nconfirmed the WRITE, the READ returning data and the query returning an\nempty range list within microseconds. Samba does not exhibit this; its\nquery is coherent with the written data.\n\nWrite back the dirty pages, drain any outstanding I/O and issue an SMB2\nFLUSH to force the server to commit the data before querying the\nallocated ranges, so the query reflects the data actually present.\n\nWith this, generic/363 passes against both Windows Server 2022 and Samba\nover 100000 fsx operations."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "966a3cb7c7db786452a87afdc3b48858fc4d4d6b", "lessThan": "f82242fe3109a3ef72f429540b5bdde08fbfb0e4", "status": "affected", "versionType": "git"}, {"version": "966a3cb7c7db786452a87afdc3b48858fc4d4d6b", "lessThan": "bf84e44ff0ed802778eafd7ecb623635379cb506", "status": "affected", "versionType": "git"}, {"version": "966a3cb7c7db786452a87afdc3b48858fc4d4d6b", "lessThan": "aa994489bd835547c191827acc460192e147032d", "status": "affected", "versionType": "git"}, {"version": "c406bb9ece6ef63721daab106f132ff4b4234e81", "status": "affected", "versionType": "git"}, {"version": "2f9f4a2d0e6fcf0673ed51195e06e47abe966900", "status": "affected", "versionType": "git"}, {"version": "5e397c943424de94879830e72c95f2679e297a76", "status": "affected", "versionType": "git"}, {"version": "5.10.50", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.12.17", "lessThan": "5.13", "status": "affected", "versionType": "semver"}, {"version": "5.13.2", "lessThan": "5.14", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f82242fe3109a3ef72f429540b5bdde08fbfb0e4"}, {"url": "https://git.kernel.org/stable/c/bf84e44ff0ed802778eafd7ecb623635379cb506"}, {"url": "https://git.kernel.org/stable/c/aa994489bd835547c191827acc460192e147032d"}], "title": "smb: client: flush and commit data before querying allocated ranges", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f82242fe3109a3ef72f429540b5bdde08fbfb0e4", "status": "affected", "version": "966a3cb7c7db786452a87afdc3b48858fc4d4d6b", "versionType": "git"}, {"lessThan": "bf84e44ff0ed802778eafd7ecb623635379cb506", "status": "affected", "version": "966a3cb7c7db786452a87afdc3b48858fc4d4d6b", "versionType": "git"}, {"lessThan": "aa994489bd835547c191827acc460192e147032d", "status": "affected", "version": "966a3cb7c7db786452a87afdc3b48858fc4d4d6b", "versionType": "git"}, {"status": "affected", "version": "c406bb9ece6ef63721daab106f132ff4b4234e81", "versionType": "git"}, {"status": "affected", "version": "2f9f4a2d0e6fcf0673ed51195e06e47abe966900", "versionType": "git"}, {"status": "affected", "version": "5e397c943424de94879830e72c95f2679e297a76", "versionType": "git"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.50", "versionType": "semver"}, {"lessThan": "5.13", "status": "affected", "version": "5.12.17", "versionType": "semver"}, {"lessThan": "5.14", "status": "affected", "version": "5.13.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: flush and commit data before querying allocated ranges\n\nThe mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior\nranges in smb3_simple_fallocate_range() issues\nFSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server\nreports as an unallocated hole, to force block allocation without\nchanging file contents.\n\nThis is unsafe against Windows servers. Per the Win32 documentation,\nFSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain\nnonzero data and is explicitly not coherent with recently written data:\n\n \"a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network\n file] would not necessarily return a correct list of allocated\n regions. To ensure coherency [...] flush the data to the file\"\n\nfsx (generic/363) reproduces the resulting corruption against Windows\nServer 2022: a range is written, an uncached read returns the data, yet\nthe next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole\nhole, so the emulation overwrites live data with zeroes. A network trace\nconfirmed the WRITE, the READ returning data and the query returning an\nempty range list within microseconds. Samba does not exhibit this; its\nquery is coherent with the written data.\n\nWrite back the dirty pages, drain any outstanding I/O and issue an SMB2\nFLUSH to force the server to commit the data before querying the\nallocated ranges, so the query reflects the data actually present.\n\nWith this, generic/363 passes against both Windows Server 2022 and Samba\nover 100000 fsx operations."}], "id": "CVE-2026-98684", "lastModified": "2026-10-19T10:19:32.823", "metrics": {}, "published": "2026-10-18T16:17:21.770", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aa994489bd835547c191827acc460192e147032d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf84e44ff0ed802778eafd7ecb623635379cb506"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f82242fe3109a3ef72f429540b5bdde08fbfb0e4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb: client: flush and commit data before querying allocated ranges", "id": "2555070", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555070"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-820", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: flush and commit data before querying allocated ranges\nThe mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior\nranges in smb3_simple_fallocate_range() issues\nFSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server\nreports as an unallocated hole, to force block allocation without\nchanging file contents.\nThis is unsafe against Windows servers. Per the Win32 documentation,\nFSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain\nnonzero data and is explicitly not coherent with recently written data:\n\"a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network\nfile] would not necessarily return a correct list of allocated\nregions. To ensure coherency [...] flush the data to the file\"\nfsx (generic/363) reproduces the resulting corruption against Windows\nServer 2022: a range is written, an uncached read returns the data, yet\nthe next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole\nhole, so the emulation overwrites live data with zeroes. A network trace\nconfirmed the WRITE, the READ returning data and the query returning an\nempty range list within microseconds. Samba does not exhibit this; its\nquery is coherent with the written data.\nWrite back the dirty pages, drain any outstanding I/O and issue an SMB2\nFLUSH to force the server to commit the data before querying the\nallocated ranges, so the query reflects the data actually present.\nWith this, generic/363 passes against both Windows Server 2022 and Samba\nover 100000 fsx operations.", "A flaw was found in the Linux kernel's Server Message Block (SMB) client. When performing file space allocation operations against certain remote servers, such as Windows servers, the client queries allocated file ranges before flushing recently written data. Because the remote server may report uncommitted ranges as empty space, the client can incorrectly overwrite live data with zeroes. A local user performing file allocation operations on an SMB share can trigger this flaw, resulting in silent data corruption."], "name": "CVE-2026-98684", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98684\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98684\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98684.mbox"], "threat_severity": "Low"}