CVE-2026-68388 Overview
CVE-2026-68388 is a Linux kernel vulnerability in the SMB client (smb/client) fallocate implementation. The function smb3_simple_fallocate_range() mishandles allocated ranges that start before the current fallocate offset. When the SMB server returns an overlapping allocated range, the code advances the offset by the full server range length instead of only the overlapping portion. This leaves holes unzeroed while still returning success to userspace, and can also trigger an out-of-bounds zero-buffer read when a malformed range length is returned.
Critical Impact
A later write to the skipped hole may fail with ENOSPC, and a malformed server response can cause an out-of-bounds read in kernel memory.
Affected Products
- Linux kernel SMB client (fs/smb/client) implementations containing smb3_simple_fallocate_range()
- Systems mounting remote shares over SMB3 that rely on fallocate(2) semantics
- Distribution kernels prior to the fixes referenced in the upstream stable commits
Discovery Timeline
- 2026-08-10 - CVE-2026-68388 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68388
Vulnerability Analysis
The smb3_simple_fallocate_range() function queries the server for allocated ranges so that it can preserve existing file contents and zero-fill only the holes within the requested fallocate window. The server may return an allocated range that begins before the current fallocate offset. The vulnerable code adds the full server-returned range length to the current offset rather than only the overlapping portion.
Consider a fallocate request for [100, 400) where the server reports [0, 200) as allocated. The correct behavior is to skip [100, 200) and zero-fill [200, 400). The vulnerable code instead advances from offset 100 by the full length 200, landing at offset 300. The range [200, 300) is treated as already allocated and never zero-filled, while fallocate(2) still returns success.
A subsequent write into the unzeroed hole can fail with ENOSPC, breaking the guarantees applications expect from fallocate. In addition, a malformed range length returned by a malicious or compromised server can cause the offset arithmetic to overflow, leading to an out-of-bounds read from the kernel zero buffer.
Root Cause
The root cause is incorrect offset arithmetic when reconciling server-reported allocated ranges with the client's current fallocate cursor. The code fails to clip ranges that begin before the current offset and does not validate ranges whose end offset would overflow. This is a boundary condition error in kernel file system logic.
Attack Vector
Exploitation requires a client to perform fallocate(2) operations against a controlled or malicious SMB server. A hostile server can craft responses to FSCTL_QUERY_ALLOCATED_RANGES with overlapping or malformed length fields. The result is either silent data corruption on the client or an out-of-bounds kernel read from the zero buffer used during hole filling.
No synthetic exploit code is published for this issue. See the upstream stable commits referenced below for the exact patch semantics: Kernel Git Commit 377fe3e, Kernel Git Commit 437637f, Kernel Git Commit 7e08ab7, Kernel Git Commit a4a09e5, and Kernel Git Commit b09ae45.
Detection Methods for CVE-2026-68388
Indicators of Compromise
- Unexpected ENOSPC errors on writes to files previously extended with fallocate(2) over SMB mounts.
- Kernel log entries referencing smb3_simple_fallocate_range or SMB client faults during file preallocation.
- SMB traffic containing FSCTL_QUERY_ALLOCATED_RANGES responses with ranges beginning before the requested offset or with overflowing length fields.
Detection Strategies
- Compare running kernel versions against the patched stable releases referenced by the upstream commits.
- Audit mount tables for cifs or smb3 mounts pointing at untrusted servers where a client can be induced to call fallocate.
- Monitor for anomalous SMB server responses using network inspection tools capable of parsing SMB2/3 FSCTL payloads.
Monitoring Recommendations
- Collect kernel logs (dmesg, journalctl -k) centrally and alert on SMB client faults or filesystem errors on hosts using SMB mounts.
- Track fallocate-related failures in application logs on hosts that preallocate files on remote shares.
- Inventory Linux hosts and correlate installed kernel versions against vendor advisories tracking CVE-2026-68388.
How to Mitigate CVE-2026-68388
Immediate Actions Required
- Update affected Linux kernels to a stable release containing the fixes in the referenced upstream commits.
- Restrict SMB client mounts to trusted servers until patches are deployed.
- Audit workloads that call fallocate(2) on SMB-mounted files and validate written data integrity after preallocation.
Patch Information
Upstream fixes are available in the Linux stable tree. Refer to Kernel Git Commit 377fe3e, Kernel Git Commit 437637f, Kernel Git Commit 7e08ab7, Kernel Git Commit a4a09e5, and Kernel Git Commit b09ae45. The patches advance only over the overlapping portion of the allocated range, ignore ranges ending before the current offset, and reject ranges whose end offset would overflow.
Workarounds
- Avoid fallocate(2) on files hosted on SMB shares served by untrusted or unpatched servers until the kernel patch is applied.
- Where possible, mount SMB shares read-only on hosts that do not require write access.
- Segment networks so that Linux clients only reach vetted SMB servers, reducing exposure to malicious response payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
