In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 /… (CVE-2026-98684)

The Linux kernel SMB client had a vulnerability in its fallocate emulation (mode 0 / FALLOC_FL_KEEP_SIZE) for small interior ranges. It used FSCTL_QUERY_ALLOCATED_RANGES to identify unallocated holes and zero-fill them to force block allocation without changing file contents. However, Windows servers' FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that may contain nonzero data and is not coherent with recent writes unless data is flushed. This caused the client to overwrite live data with zeroes after a write operation. The issue was demonstrated against Windows Server 2022 using fsx (generic/363). The fix involves flushing dirty pages, draining outstanding I/O, and issuing an SMB2 FLUSH to ensure the query reflects the actual data present, preventing corruption.

Without the fix, the Linux kernel SMB client may corrupt data by zero-filling live data ranges after writes when interacting with Windows servers. This can lead to data loss or corruption on network file systems using SMB3 with fallocate emulation. The issue specifically affects interactions with Windows Server 2022 and similar SMB servers that do not guarantee coherency of FSCTL_QUERY_ALLOCATED_RANGES without flushing.

A fix has been implemented in the Linux kernel that flushes dirty pages, drains outstanding I/O, and issues an SMB2 FLUSH before querying allocated ranges. Users should update to a Linux kernel version that includes this fix. No additional mitigation is required if the fix is applied.