---
id: CVE-2026-98684
title: 'smb: client: flush and commit data before querying allocated ranges'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: flush and commit data before querying allocated ranges

  The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior
  ranges in smb3_simple_fallo…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 966a3cb7c7db786452a87afdc3b48858fc4d4d6b <
    f82242fe3109a3ef72f429540b5bdde08fbfb0e4
  - >-
    Linux >= 966a3cb7c7db786452a87afdc3b48858fc4d4d6b <
    bf84e44ff0ed802778eafd7ecb623635379cb506
  - >-
    Linux >= 966a3cb7c7db786452a87afdc3b48858fc4d4d6b <
    aa994489bd835547c191827acc460192e147032d
  - Linux c406bb9ece6ef63721daab106f132ff4b4234e81
  - Linux 2f9f4a2d0e6fcf0673ed51195e06e47abe966900
  - Linux 5e397c943424de94879830e72c95f2679e297a76
  - Linux >= 5.10.50 < 5.11
  - Linux >= 5.12.17 < 5.13
  - Linux >= 5.13.2 < 5.14
  - Linux 5.14
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:45:52.828Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98684'
references:
  - url: 'https://git.kernel.org/stable/c/f82242fe3109a3ef72f429540b5bdde08fbfb0e4'
  - url: 'https://git.kernel.org/stable/c/bf84e44ff0ed802778eafd7ecb623635379cb506'
  - url: 'https://git.kernel.org/stable/c/aa994489bd835547c191827acc460192e147032d'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.528Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: flush and commit data before querying allocated ranges

The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior
ranges in smb3_simple_fallocate_range() issues
FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server
reports as an unallocated hole, to force block allocation without
changing file contents.

This is unsafe against Windows servers.  Per the Win32 documentation,
FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain
nonzero data and is explicitly not coherent with recently written data:

  "a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network
   file] would not necessarily return a correct list of allocated
   regions.  To ensure coherency [...] flush the data to the file"

fsx (generic/363) reproduces the resulting corruption against Windows
Server 2022: a range is written, an uncached read returns the data, yet
the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole
hole, so the emulation overwrites live data with zeroes.  A network trace
confirmed the WRITE, the READ returning data and the query returning an
empty range list within microseconds.  Samba does not exhibit this; its
query is coherent with the written data.

Write back the dirty pages, drain any outstanding I/O and issue an SMB2
FLUSH to force the server to commit the data before querying the
allocated ranges, so the query reflects the data actually present.

With this, generic/363 passes against both Windows Server 2022 and Samba
over 100000 fsx operations.

## Affected

- `Linux >= 966a3cb7c7db786452a87afdc3b48858fc4d4d6b < f82242fe3109a3ef72f429540b5bdde08fbfb0e4`
- `Linux >= 966a3cb7c7db786452a87afdc3b48858fc4d4d6b < bf84e44ff0ed802778eafd7ecb623635379cb506`
- `Linux >= 966a3cb7c7db786452a87afdc3b48858fc4d4d6b < aa994489bd835547c191827acc460192e147032d`
- `Linux c406bb9ece6ef63721daab106f132ff4b4234e81`
- `Linux 2f9f4a2d0e6fcf0673ed51195e06e47abe966900`
- `Linux 5e397c943424de94879830e72c95f2679e297a76`
- `Linux >= 5.10.50 < 5.11`
- `Linux >= 5.12.17 < 5.13`
- `Linux >= 5.13.2 < 5.14`
- `Linux 5.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.