{ "cveId": "CVE-2026-98684", "url": "https://patchblox.com/security/cve/CVE-2026-98684", "summary": "CVE-2026-98684 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-98684, released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "smb: client: flush and commit data before querying allocated ranges", "description": "In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOC_FL_KEEP_SIZE fallocate emulation for small interior ranges in smb3_simple_fallocate_range() issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills any sub-range the server reports as an unallocated hole, to force block allocation without changing file contents. This is unsafe against Windows servers. Per the Win32 documentation, FSCTL_QUERY_ALLOCATED_RANGES only reports ranges that *may* contain nonzero data and is explicitly not coherent with recently written data: \u0022a call to FSCTL_QUERY_ALLOCATED_RANGES [after writing to a network file] would not necessarily return a correct list of allocated regions. To ensure coherency [...] flush the data to the file\u0022 fsx (generic/363) reproduces the resulting corruption against Windows Server 2022: a range is written, an uncached read returns the data, yet the next FSCTL_QUERY_ALLOCATED_RANGES on that range reports it as a whole hole, so the emulation overwrites live data with zeroes. A network trace confirmed the WRITE, the READ returning data and the query returning an empty range list within microseconds. Samba does not exhibit this; its query is coherent with the written data. Write back the dirty pages, drain any outstanding I/O and issue an SMB2 FLUSH to force the server to commit the data before querying the allocated ranges, so the query reflects the data actually present. With this, generic/363 passes against both Windows Server 2022 and Samba over 100000 fsx operations.", "published": "2026-10-18T16:17:21Z", "severity": "Low", "cvss": 2.5, "epss": 0.00166, "epssPercentile": 0.05859, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98684", "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.56-125.164", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.2.10-1", "fix": "DEBIAN-CVE-2026-98684", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98684", "released": "2026-10-19T16:27:52Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.56-125.164.amzn2023", "fix": "ALAS2023-2026-3251", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3251", "released": "2026-11-07T01:06:52Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T00:53:09Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }