CVE-2026-98683: Linux Kernel SMB Information Disclosure

CVE-2026-98683 Overview

CVE-2026-98683 is a Linux kernel vulnerability in the SMB (Server Message Block) client implementation. The flaw resides in smb3_zero_range(), which emulates FALLOC_FL_ZERO_RANGE by invalidating the page cache and issuing FSCTL_SET_ZERO_DATA to the server. Dirty data flushing occurred only when the target range reached or extended end-of-file (EOF). For purely interior zero ranges, dirty folios overlapping the range could be written back to the server after the FSCTL completed, refilling the zeroed region with stale data. The issue is observed with generic/363 reading stale data against Windows Server where zeroed content is expected.

Critical Impact
SMB clients may silently return stale file data in regions that applications requested to be zeroed, resulting in data integrity failures for workloads relying on FALLOC_FL_ZERO_RANGE semantics.

Affected Products

Linux kernel SMB/CIFS client (fs/smb/client)
Systems mounting SMB3 shares and using fallocate() with FALLOC_FL_ZERO_RANGE
Workloads interoperating with Windows Server over SMB3

Discovery Timeline

2026-10-18 - CVE-2026-98683 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98683

Vulnerability Analysis

The Linux SMB client exposes fallocate() modes to userspace, including FALLOC_FL_ZERO_RANGE. The server-side emulation path smb3_zero_range() performs two actions: it invalidates the page cache using truncate_pagecache_range(), then issues an FSCTL_SET_ZERO_DATA request to the SMB server. The server zeroes the range on-disk.

The ordering assumption is that no dirty client-side pages remain over the target range when the FSCTL executes. Prior to the fix, the client only flushed dirty data when the requested range reached or extended beyond EOF. For an interior range entirely below EOF, the flush was skipped. A dirty folio overlapping the range could then be written back to the server after FSCTL_SET_ZERO_DATA completed, overwriting the freshly zeroed bytes with stale cached content.

Root Cause

The root cause is a conditional flush in smb3_zero_range() that failed to cover interior ranges. The code structure diverged from the analogous smb3_punch_hole() path, which was already corrected in commit d7d2adcd022b ("smb/client: flush dirty data before punching a hole"). Both operations require identical ordering guarantees between client-side writeback and server-side range mutation.

Attack Vector

This is a data integrity defect rather than a remotely exploitable code execution flaw. Any process issuing fallocate(fd, FALLOC_FL_ZERO_RANGE, offset, len) against a file on an SMB3 mount can observe stale data in the supposedly zeroed region. Reproduction is deterministic under the generic/363 fstests workload against Windows Server. See the upstream fix commits 8f8d32c, cecf411, and e8ba21c for the structural change that unconditionally flushes dirty data before invalidation.

Detection Methods for CVE-2026-98683

Indicators of Compromise

Applications reading non-zero bytes from file regions that were explicitly zeroed via fallocate() with FALLOC_FL_ZERO_RANGE on SMB3 mounts.
generic/363 xfstests failures reporting stale data on CIFS/SMB3 mounts backed by Windows Server targets.
Checksum or integrity mismatches in databases, virtual disk images, or sparse files hosted on SMB3 shares.

Detection Strategies

Enumerate running kernel versions across the fleet and correlate against the fixed stable branches referenced in the upstream commits.
Audit workloads that mount SMB3 shares and invoke fallocate() zero-range semantics, including container runtimes and backup agents.
Run generic/363 from fstests against representative SMB3 mounts to validate whether zero-range operations return expected content.

Monitoring Recommendations

Track kernel package versions and SMB client module (cifs.ko) versions through configuration management.
Alert on application-layer data integrity failures originating from files on SMB-mounted paths.
Capture SMB2/3 protocol traces during zero-range operations to confirm that no post-FSCTL writes overwrite the zeroed region.

How to Mitigate CVE-2026-98683

Immediate Actions Required

Apply the kernel update containing commits 8f8d32c, cecf411, and e8ba21c once distributed by your Linux vendor.
Inventory workloads using FALLOC_FL_ZERO_RANGE on SMB3 mounts and prioritize patching those hosts first.
Validate backups and recent file content for workloads that may have silently received stale data.

Patch Information

The upstream fix flushes and waits for dirty data in the target range unconditionally before invalidating the page cache and issuing FSCTL_SET_ZERO_DATA. The change mirrors the earlier smb3_punch_hole() fix in commit d7d2adcd022b. Patched kernels are available through the stable tree references listed above; consult your distribution for backported package versions.

Workarounds

Issue an explicit fsync() on the file descriptor before calling fallocate() with FALLOC_FL_ZERO_RANGE to force dirty pages to the server.
Avoid FALLOC_FL_ZERO_RANGE on SMB3 mounts and emulate the operation in userspace by writing zeros directly, followed by fsync().
Mount SMB3 shares with caching disabled (cache=none) to reduce the window for dirty page writeback races, accepting the associated performance cost.

bash

# Verify current kernel and SMB client module versions
uname -r
modinfo cifs | grep -E '^(version|srcversion):'

# Run the regression test case that exercises this path
# (requires xfstests configured with an SMB3 TEST_DEV)
./check generic/363