CVE-2024-26692

smb: Fix regression in writes when non-standard maximum write size negotiated

State
Published
Severity
8.3 High
Published
Apr 3, 2024
Updated
Aug 5, 2026
Reserved
Feb 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: Fix regression in writes when non-standard maximum write size negotiated

The conversion to netfs in the 6.3 kernel caused a regression when maximum write size is set by the server to an unexpected value which is not a multiple of 4096 (similarly if the user overrides the maximum write size by setting mount parm "wsize", but sets it to a value that is not a multiple of 4096). When negotiated write size is not a multiple of 4096 the netfs code can skip the end of the final page when doing large sequential writes, causing data corruption.

This section of code is being rewritten/removed due to a large netfs change, but until that point (ie for the 6.3 kernel until now) we can not support non-standard maximum write sizes.

Add a warning if a user specifies a wsize on mount that is not a multiple of 4096 (and round down), also add a change where we round down the maximum write size if the server negotiates a value that is not a multiple of 4096 (we also have to check to make sure that we do not round it down to zero).

Scores

CVSSScoreVectorSource
3.18.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before 4145ccff546ea868428b3e0fe6818c6261b574a9Affected
  • d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before 63c35afd50e28b49c5b75542045a8c42b696dab9Affected
  • d08089f649a0cfb2099c8551ac47eef0cc23fdf2 to before 4860abb91f3d7fbaf8147d54782149bb1fc45892Affected
LinuxLinux
  • 6.3Affected
  • before 6.3Not affected
  • 6.6.18 through 6.6.*Not affected
  • 6.7.6 through 6.7.*Not affected
  • 6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.