CVE-2024-26692

What it actually does

The SMB client in the Linux kernel fails to properly handle maximum write sizes that are not multiples of 4096 bytes, resulting in skipped data at the end of the final page during large sequential writes and subsequent data corruption.

Why it matters to the business

Organizations using Linux systems to access SMB shares with non-standard write sizes may experience silent data corruption during file writes, leading to data integrity issues and potential operational disruptions.

How an attack unfolds

The flaw manifests when a server negotiates a maximum write size not divisible by 4096 or when a user specifies a non-conforming wsize mount option; large sequential writes then skip the tail of the final page, corrupting data. No active exploitation or named threat actors are associated with this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit 4145ccff546ea868428b3e0fe6818c6261b574a9. If a custom wsize is used, ensure it is a multiple of 4096; the kernel now emits a warning and rounds down non-conforming values.

How to confirm the fix worked

Verify the running kernel contains commit 4145ccff546ea868428b3e0fe6818c6261b574a9 or later equivalent; test by mounting with a non-multiple wsize and confirming the kernel rounds the value and logs a warning.

Typical attack path

1. Mount an SMB share where the server negotiates a maximum write size not divisible by 4096 or explicitly set a non-conforming wsize
2. Perform large sequential writes to files on the share
3. Observe data corruption at page boundaries in the written files

How to detect it

Review kernel logs for warnings about non-multiple wsize values; investigate any reports of data corruption or integrity failures on files written to SMB shares.

What your security team should do

• Apply the kernel fix containing commit 4145ccff546ea868428b3e0fe6818c6261b574a9 across all affected systems
• Audit SMB mount options and remove or correct any wsize values not divisible by 4096
• Monitor for data-integrity anomalies on SMB shares after applying the update