CVE-2026-68388

A flaw was found in the Linux kernel's Server Message Block (SMB) client. The smb3_simple_fallocate_range() function, which manages file allocation, can incorrectly process overlapping allocated ranges provided by a server. This can result in parts of a file not being properly zero-filled, leading to potential data integrity issues. More critically, a malformed range length could cause an out-of-bounds read, potentially leading to information disclosure or system instability.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires an active SMB/CIFS mount and interaction with an untrusted or compromised remote file server. On typical enterprise deployments, the CIFS kernel module is not loaded by default unless SMB network shares are explicitly mounted by an administrator or user. While an out-of-bounds read or incomplete zero-filling could lead to memory disclosure or data inconsistencies, the flaw cannot be triggered across the network without client-initiated file operations on an established SMB connection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.