Cloudanix VulnDB

CVE-2026-68388

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Linux kernel's handling of file space allocation over network shares can leave parts of files unwritten or cause later writes to fail unexpectedly.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper handling of overlapping allocated ranges returned by an SMB server in smb3_simple_fallocate_range() causes holes to be skipped without zero-filling and can trigger out-of-bounds zero-buffer reads on malformed range lengths.

Why it matters to the business

File operations over SMB mounts may silently leave uninitialized data or later fail with storage errors, reducing reliability of networked file systems and potentially requiring data recovery or application restarts on affected kernels.

How an attack unfolds

An attacker who controls or influences an SMB3 server returns an allocated range that starts before the client's fallocate offset or contains a malformed length; the client incorrectly advances its offset, skips zero-filling a hole, and may read beyond a buffer boundary, leading to either uninitialized data exposure or kernel memory corruption on subsequent writes.

How to fix it

Upgrade to a fixed kernel: Red Hat Enterprise Linux 10 to 6.12.0-211.49.1.el10_2, EL9 to 5.14.0-687.41.1.el9_8, EL8 to 4.18.0-553.157.1.el8_10 (or the corresponding real-time variant for EL8). Reboot after installation.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the listed fixed packages for the distribution; test fallocate on an SMB mount with overlapping server ranges and verify zero-fill behavior and absence of OOB reads.

Typical attack path

  1. Mount an SMB3 share from a server under attacker control or that returns crafted FSCTL_QUERY_ALLOCATED_RANGES responses
  2. Trigger fallocate on a file range that overlaps a server-reported allocated extent
  3. Observe skipped zero-fill or ENOSPC on later writes, or trigger the out-of-bounds read path with a crafted range length

How to detect it

Review kernel logs for ENOSPC errors immediately following fallocate calls on SMB mounts; inspect SMB3 traffic for FSCTL_QUERY_ALLOCATED_RANGES responses whose start offset precedes the client's requested range; search for crash dumps referencing smb3_simple_fallocate_range or out-of-bounds accesses in the SMB client path.

What your security team should do

  • Prioritize kernel updates on all systems mounting SMB3 shares, especially those reachable from untrusted servers
  • Apply the listed Red Hat advisories within the published timelines
  • Monitor for unexpected ENOSPC errors on SMB writes as a behavioral indicator until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: smb/client: handle overlapping allocated ranges in fallocate smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled, but fallocate still returns success. A later write to that hole may therefore fail with ENOSPC. The function queries allocated ranges so that it can preserve existing contents and write zeroes only into holes. However, the server may return a range that starts before the current fallocate offset. For example, assume the fallocate request is [100, 400) and the only allocated range returned by the server is [0, 200): Request: [100, 400) Server range: [ 0, 200) allocated Correct: [100, 200) allocated data, skip [200, 400) hole, zero-fill Current: [100, 300) skipped [300, 400) zero-filled afterwards The current code adds the full server range length, 200, to the current offset 100 and moves to 300. As a result, the hole in [200, 300) is skipped without being zero-filled. Fix this by advancing only over the part of the allocated range that overlaps the current fallocate offset. Ignore ranges that end before the current offset and reject ranges whose end offset overflows. This also prevents a malformed range length from causing an out-of-bounds zero-buffer read.

Affected packages

Ecosystem Package Introduced Fixed