CVE-2026-68388 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
smb/client: handle overlapping allocated ranges in fallocate
smb3_simple_fallocate_range() can skip holes when an allocated range returned by the server starts before the current fallocate offset. The skipped hole is not zero-filled, but fallocate still returns success. A later write to that hole may therefore fail with ENOSPC.
The function queries allocated ranges so that it can preserve existing contents and write zeroes only into holes. However, the server may return a range that starts before the current fallocate offset.
For example, assume the fallocate request is [100, 400) and the only
allocated range returned by the server is [0, 200):
Request: [100, 400)
Server range: [ 0, 200) allocated
Correct: [100, 200) allocated data, skip
[200, 400) hole, zero-fill
Current: [100, 300) skipped
[300, 400) zero-filled afterwards
The current code adds the full server range length, 200, to the current offset 100 and moves to 300. As a result, the hole in [200, 300) is
skipped without being zero-filled.
Fix this by advancing only over the part of the allocated range that overlaps the current fallocate offset. Ignore ranges that end before the current offset and reject ranges whose end offset overflows.
This also prevents a malformed range length from causing an out-of-bounds zero-buffer read.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides in the smb3_simple_fallocate_range() function within the Linux kernel's SMB client implementation, specifically addressing how overlapping allocated ranges are handled during file allocation operations. This issue manifests when the server returns allocated ranges that begin before the current fallocate offset, creating a scenario where holes within the requested allocation range are not properly zero-filled. The flaw originates from improper range boundary calculations that fail to account for partial overlaps between server-provided ranges and the current fallocate operation parameters.
The technical implementation error stems from how the function processes allocated ranges returned by the SMB server during fallocate operations. When querying existing allocated ranges to preserve data integrity, the code incorrectly advances the current offset by the entire server range length rather than only the overlapping portion. This miscalculation occurs because the function does not properly handle cases where server ranges extend beyond the current fallocate boundary, leading to incorrect hole detection and zero-filling behavior. The vulnerability specifically affects the SMB3 client implementation and represents a classic case of improper range arithmetic that can be categorized under CWE-129 Input Validation and CWE-787 Out-of-bounds Write.
The operational impact of this vulnerability extends beyond simple file allocation failures, potentially creating data corruption scenarios and unexpected ENOSPC errors during subsequent write operations. When a hole is skipped without proper zero-filling, later writes to that location may fail with ENOSPC, disrupting normal file system operations and application behavior. This issue particularly affects applications that rely on consistent file allocation patterns and can lead to unpredictable behavior in storage-intensive workloads where multiple concurrent fallocate operations occur. The vulnerability also introduces potential denial-of-service conditions when applications encounter unexpected ENOSPC errors during write operations.
The fix implemented addresses the core range handling logic by ensuring that only the overlapping portion of server-returned ranges is considered when advancing the current offset. This approach prevents the skipping of holes that should be zero-filled and eliminates the out-of-bounds buffer read risk associated with malformed range lengths. The solution properly handles edge cases where ranges begin before the current offset by ignoring such ranges entirely, while also implementing overflow protection for ranges whose end offsets exceed system limits. This remediation aligns with security best practices for input validation and boundary checking, reducing the attack surface for potential exploitation through malformed SMB server responses and addressing ATT&CK techniques related to privilege escalation through file system manipulation.
The vulnerability demonstrates a critical flaw in how kernel-level file system operations handle distributed storage protocols, particularly in scenarios involving complex range management across network file systems. The fix ensures proper overlap calculation that maintains data consistency while preventing buffer overflows that could potentially be exploited for privilege escalation or denial-of-service attacks. This implementation addresses fundamental security requirements for maintaining file system integrity in networked environments and aligns with industry standards for secure kernel development practices. The resolution effectively prevents both immediate operational failures and potential long-term security implications that could arise from improper range handling in SMB client implementations.