CVE-2026-68388: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68388 is a vulnerability in the Linux kernel's SMB/CIFS client (smb/client) involving improper handling of overlapping allocated ranges during fallocate operations. The flaw exists in smb3_simple_fallocate_range(), which can skip holes without zero-filling them when a server-returned allocated range starts before the current fallocate offset, causing fallocate to return success while leaving uninitialized data in the file. Affected kernel versions include 5.10.50–5.10.264, 5.12.17–5.12.x, 5.13.2–5.13.x, and 5.14 and later up to the fixed releases. It was published on August 10, 2026, with Red Hat errata issued on August 20, 2026. The CVSS v3.1 base score is 9.8 (Critical), though the actual impact is more consistent with a Denial of Service scenario (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-131 (Incorrect Calculation of Buffer Size). In smb3_simple_fallocate_range(), when the SMB server returns an allocated range that begins before the current fallocate offset, the code incorrectly adds the full server range length to the current offset rather than only the overlapping portion. For example, given a fallocate request of [100, 400) and a server-returned range of [0, 200), the code advances the offset to 300 instead of 200, leaving the hole at [200, 300) unzeroed. This logic error also allows a malformed range length from a server response to trigger an out-of-bounds zero-buffer read. The fix advances the offset only over the overlapping portion of the allocated range, ignores ranges ending before the current offset, and rejects ranges whose end offset overflows (GitHub Advisory, Red Hat Bugzilla).

The primary impact is a Denial of Service: fallocate operations appear to succeed but leave file holes uninitialized, causing subsequent write operations to those holes to fail with ENOSPC errors and disrupting normal file I/O on SMB-mounted filesystems. Additionally, a malformed server response could trigger an out-of-bounds read of a zero-buffer in kernel memory, which may have secondary confidentiality or stability implications. Systems using the Linux kernel SMB/CIFS client to mount remote SMB3 shares are affected (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.17–0.52% (low-to-moderate probability of exploitation within 30 days). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require an attacker to control or influence an SMB server's responses to a connecting Linux client, making opportunistic exploitation less likely but targeted attacks against misconfigured or malicious SMB servers plausible (GitHub Advisory, Red Hat Bugzilla).

Update the Linux kernel to a fixed version: 5.10.265 or later (5.10.x branch), 5.15.216 or later (5.15.x), 6.1.183 or later (6.1.x), 6.6.148 or later (6.6.x), 6.12.101 or later (6.12.x), 6.18.42 or later (6.18.x), 7.1.6 or later (7.1.x), or 7.2+. Red Hat Enterprise Linux users should apply the errata RHSA-2026:57251 (RHEL 10), RHSA-2026:57252 (RHEL 9), RHSA-2026:57253 (RHEL 8), or RHSA-2026:57254 (RHEL 8) as appropriate. As a workaround where patching is not immediately possible, avoid using fallocate operations on SMB-mounted filesystems or restrict SMB client connections to trusted servers only (Red Hat Bugzilla, GitHub Advisory).

Red Hat triaged the issue at medium severity and issued four errata (RHSA-2026:57251 through RHSA-2026:57254) addressing RHEL 8, 9, and 10 on August 20, 2026. The upstream kernel fix was referenced in the linux-cve-announce mailing list. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking (Red Hat Bugzilla).