CVE-2024-26692

smb: Fix regression in writes when non-standard maximum write size negotiated

MEDIUM
5.5
CVSS Score
Published: April 3, 2024 at 02:54 PM UTC
Updated: August 5, 2026 at 12:04 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: smb: Fix regression in writes when non-standard maximum write size negotiated The conversion to netfs in the 6.3 kernel caused a regression when maximum write size is set by the server to an unexpected value which is not a multiple of 4096 (similarly if the user overrides the maximum write size by setting mount parm "wsize", but sets it to a value that is not a multiple of 4096). When negotiated write size is not a multiple of 4096 the netfs code can skip the end of the final page when doing large sequential writes, causing data corruption. This section of code is being rewritten/removed due to a large netfs change, but until that point (ie for the 6.3 kernel until now) we can not support non-standard maximum write sizes. Add a warning if a user specifies a wsize on mount that is not a multiple of 4096 (and round down), also add a change where we round down the maximum write size if the server negotiates a value that is not a multiple of 4096 (we also have to check to make sure that we do not round it down to zero).

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.3 ≤ v < 6.6.186.3 ≤ v < 6.7.66.3 ≤ v < 6.86.7 ≤ v < 6.7.66.8 rc16.8 rc26.8 rc36.8 rc4d08089f649a0cfb2099c8551ac47eef0cc23fdf2
Vendor states this is fixed in 4145ccff546ea868428b3e0fe6818c6261b574a9 (fixed)
Vendor states this is fixed in 4860abb91f3d7fbaf8147d54782149bb1fc45892 (fixed)
Vendor states this is fixed in 63c35afd50e28b49c5b75542045a8c42b696dab9 (fixed)
Vendor states this is fixed in 6.3 (unaffected)
Vendor states this is fixed in 6.6.18 (unaffected)
Vendor states this is fixed in 6.7.6 (unaffected)
Vendor states this is fixed in 6.8 (unaffected)

References (3)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-787

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card