GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26692 (GCVE-0-2024-26692)

Vulnerability from cvelistv5 – Published: 2024-04-03 14:54 – Updated: 2026-08-05 11:26
VLAI
Title
smb: Fix regression in writes when non-standard maximum write size negotiated
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: Fix regression in writes when non-standard maximum write size negotiated The conversion to netfs in the 6.3 kernel caused a regression when maximum write size is set by the server to an unexpected value which is not a multiple of 4096 (similarly if the user overrides the maximum write size by setting mount parm "wsize", but sets it to a value that is not a multiple of 4096). When negotiated write size is not a multiple of 4096 the netfs code can skip the end of the final page when doing large sequential writes, causing data corruption. This section of code is being rewritten/removed due to a large netfs change, but until that point (ie for the 6.3 kernel until now) we can not support non-standard maximum write sizes. Add a warning if a user specifies a wsize on mount that is not a multiple of 4096 (and round down), also add a change where we round down the maximum write size if the server negotiates a value that is not a multiple of 4096 (we also have to check to make sure that we do not round it down to zero).
Severity
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:53 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d08089f649a0cfb2099c8551ac47eef0cc23fdf2 , < 4145ccff546ea868428b3e0fe6818c6261b574a9 (git)
Affected: d08089f649a0cfb2099c8551ac47eef0cc23fdf2 , < 63c35afd50e28b49c5b75542045a8c42b696dab9 (git)
Affected: d08089f649a0cfb2099c8551ac47eef0cc23fdf2 , < 4860abb91f3d7fbaf8147d54782149bb1fc45892 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.18 , ≤ 6.6.* (semver)
Unaffected: 6.7.6 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.775Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26692",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:53:00.719188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:31.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c",
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4145ccff546ea868428b3e0fe6818c6261b574a9",
              "status": "affected",
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "versionType": "git"
            },
            {
              "lessThan": "63c35afd50e28b49c5b75542045a8c42b696dab9",
              "status": "affected",
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "versionType": "git"
            },
            {
              "lessThan": "4860abb91f3d7fbaf8147d54782149bb1fc45892",
              "status": "affected",
              "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/connect.c",
            "fs/smb/client/fs_context.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Fix regression in writes when non-standard maximum write size negotiated\n\nThe conversion to netfs in the 6.3 kernel caused a regression when\nmaximum write size is set by the server to an unexpected value which is\nnot a multiple of 4096 (similarly if the user overrides the maximum\nwrite size by setting mount parm \"wsize\", but sets it to a value that\nis not a multiple of 4096).  When negotiated write size is not a\nmultiple of 4096 the netfs code can skip the end of the final\npage when doing large sequential writes, causing data corruption.\n\nThis section of code is being rewritten/removed due to a large\nnetfs change, but until that point (ie for the 6.3 kernel until now)\nwe can not support non-standard maximum write sizes.\n\nAdd a warning if a user specifies a wsize on mount that is not\na multiple of 4096 (and round down), also add a change where we\nround down the maximum write size if the server negotiates a value\nthat is not a multiple of 4096 (we also have to check to make sure that\nwe do not round it down to zero)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The attacker-controlled input is the MaxWriteSize field of the SMB2 NEGOTIATE response received over TCP/445 from a remote SMB server, copied verbatim into server-\u003emax_write with no validation. A malicious/compromised server, a DFS-referral target, or an on-path attacker (MaxWriteSize is unsigned in the pre-auth NEGOTIATE and is not covered by FSCTL_VALIDATE_NEGOTIATE_INFO) supplies it purely over the network.\nAC:L - The server simply advertises a MaxWriteSize that is not a multiple of PAGE_SIZE (or zero); there is no race, no dependency on memory layout, and no condition outside the attacker\u0027s control. Every large sequential write on the mount then corrupts deterministically.\nPR:N - The attacker is the remote SMB peer and needs no credentials or privileges on the victim client; the poisoned MaxWriteSize is delivered in the NEGOTIATE response, which precedes session setup and authentication entirely.\nUI:R - The victim must mount a CIFS/SMB share from the attacker-controlled or compromised server, since wsize is fixed at mount time in cifs_mount_get_tcon(). This is minimal interaction \u2014 an /etc/fstab, autofs, or systemd automount does it with no human present \u2014 but a mount action is still required.\nS:U - The corruption and the stuck-writeback hang are confined to the mounting kernel\u0027s page cache and the mounted share, within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:L - There is no kernel-memory disclosure, but the skipped tail regions mean in-place rewrites silently fail to overwrite: residual old file content (e.g. secrets a program believed it had replaced) persists on the share and stays readable to anyone with access to the current file. The exposure is bounded to those stale tail regions, so Low rather than High.\nI:H - The remote server fully controls how much of each page is silently discarded \u2014 up to 4095 of every 4096 bytes \u2014 while write(), close(), and fsync() all report success and the page cache masks the damage until eviction, so backups, databases, config files, and source trees are corrupted undetectably. This is complete, attacker-directed loss of integrity over all data written to the mount.\nA:H - With a server-advertised MaxWriteSize of 0, wsize becomes 0 and wdata-\u003ebytes is 0, so all three completion helpers early-return on !len and never undo the unconditional folio_start_writeback(), leaving folios permanently under writeback. That yields unkillable D-state tasks on fsync/sync/truncate/umount, permanently pinned pages, and an ever-growing NR_WRITEBACK that stalls system-wide dirty-page throttling."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:44.270Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
        }
      ],
      "title": "smb: Fix regression in writes when non-standard maximum write size negotiated",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26692",
    "datePublished": "2024-04-03T14:54:53.343Z",
    "dateReserved": "2024-02-19T14:20:24.155Z",
    "dateUpdated": "2026-08-05T11:26:44.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26692",
      "date": "2026-09-19",
      "epss": "0.00528",
      "percentile": "0.43663"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Fix regression in writes when non-standard maximum write size negotiated\n\nThe conversion to netfs in the 6.3 kernel caused a regression when\nmaximum write size is set by the server to an unexpected value which is\nnot a multiple of 4096 (similarly if the user overrides the maximum\nwrite size by setting mount parm \"wsize\", but sets it to a value that\nis not a multiple of 4096).  When negotiated write size is not a\nmultiple of 4096 the netfs code can skip the end of the final\npage when doing large sequential writes, causing data corruption.\n\nThis section of code is being rewritten/removed due to a large\nnetfs change, but until that point (ie for the 6.3 kernel until now)\nwe can not support non-standard maximum write sizes.\n\nAdd a warning if a user specifies a wsize on mount that is not\na multiple of 4096 (and round down), also add a change where we\nround down the maximum write size if the server negotiates a value\nthat is not a multiple of 4096 (we also have to check to make sure that\nwe do not round it down to zero)."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: smb: se corrigi\u00f3 la regresi\u00f3n en las escrituras cuando se negoci\u00f3 un tama\u00f1o de escritura m\u00e1ximo no est\u00e1ndar. La conversi\u00f3n a netfs en el kernel 6.3 provoc\u00f3 una regresi\u00f3n cuando el servidor estableci\u00f3 el tama\u00f1o de escritura m\u00e1ximo en un valor inesperado. que no es un m\u00faltiplo de 4096 (de manera similar, si el usuario anula el tama\u00f1o m\u00e1ximo de escritura configurando el par\u00e1metro de montaje \"wsize\", pero lo establece en un valor que no es un m\u00faltiplo de 4096). Cuando el tama\u00f1o de escritura negociado no es un m\u00faltiplo de 4096, el c\u00f3digo netfs puede omitir el final de la p\u00e1gina final al realizar escrituras secuenciales grandes, lo que provoca corrupci\u00f3n de datos. Esta secci\u00f3n de c\u00f3digo se est\u00e1 reescribiendo/eliminando debido a un gran cambio en netfs, pero hasta ese momento (es decir, para el kernel 6.3 hasta ahora) no podemos admitir tama\u00f1os m\u00e1ximos de escritura no est\u00e1ndar. Agregue una advertencia si un usuario especifica un wsize en el montaje que no es un m\u00faltiplo de 4096 (y redondea hacia abajo), tambi\u00e9n agregue un cambio donde redondeamos hacia abajo el tama\u00f1o m\u00e1ximo de escritura si el servidor negocia un valor que no es un m\u00faltiplo de 4096 ( tambi\u00e9n tenemos que comprobar que no lo redondeamos a cero)."
        }
      ],
      "id": "CVE-2024-26692",
      "lastModified": "2024-11-21T09:02:51.487",
      "published": "2024-04-03T15:15:52.610",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/connect.c",
                  "fs/smb/client/fs_context.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4145ccff546ea868428b3e0fe6818c6261b574a9",
                    "status": "affected",
                    "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63c35afd50e28b49c5b75542045a8c42b696dab9",
                    "status": "affected",
                    "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4860abb91f3d7fbaf8147d54782149bb1fc45892",
                    "status": "affected",
                    "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/smb/client/connect.c",
                  "fs/smb/client/fs_context.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DDF44457-CF5B-4B25-AD4C-B88268FE2054",
                    "versionEndExcluding": "6.6.18",
                    "versionStartIncluding": "6.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C6D6A5C8-7308-42A9-8A72-ABF3DEA4BB82",
                    "versionEndExcluding": "6.7.6",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Fix regression in writes when non-standard maximum write size negotiated\n\nThe conversion to netfs in the 6.3 kernel caused a regression when\nmaximum write size is set by the server to an unexpected value which is\nnot a multiple of 4096 (similarly if the user overrides the maximum\nwrite size by setting mount parm \"wsize\", but sets it to a value that\nis not a multiple of 4096).  When negotiated write size is not a\nmultiple of 4096 the netfs code can skip the end of the final\npage when doing large sequential writes, causing data corruption.\n\nThis section of code is being rewritten/removed due to a large\nnetfs change, but until that point (ie for the 6.3 kernel until now)\nwe can not support non-standard maximum write sizes.\n\nAdd a warning if a user specifies a wsize on mount that is not\na multiple of 4096 (and round down), also add a change where we\nround down the maximum write size if the server negotiates a value\nthat is not a multiple of 4096 (we also have to check to make sure that\nwe do not round it down to zero)."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: smb: se corrigi\u00f3 la regresi\u00f3n en las escrituras cuando se negoci\u00f3 un tama\u00f1o de escritura m\u00e1ximo no est\u00e1ndar. La conversi\u00f3n a netfs en el kernel 6.3 provoc\u00f3 una regresi\u00f3n cuando el servidor estableci\u00f3 el tama\u00f1o de escritura m\u00e1ximo en un valor inesperado. que no es un m\u00faltiplo de 4096 (de manera similar, si el usuario anula el tama\u00f1o m\u00e1ximo de escritura configurando el par\u00e1metro de montaje \"wsize\", pero lo establece en un valor que no es un m\u00faltiplo de 4096). Cuando el tama\u00f1o de escritura negociado no es un m\u00faltiplo de 4096, el c\u00f3digo netfs puede omitir el final de la p\u00e1gina final al realizar escrituras secuenciales grandes, lo que provoca corrupci\u00f3n de datos. Esta secci\u00f3n de c\u00f3digo se est\u00e1 reescribiendo/eliminando debido a un gran cambio en netfs, pero hasta ese momento (es decir, para el kernel 6.3 hasta ahora) no podemos admitir tama\u00f1os m\u00e1ximos de escritura no est\u00e1ndar. Agregue una advertencia si un usuario especifica un wsize en el montaje que no es un m\u00faltiplo de 4096 (y redondea hacia abajo), tambi\u00e9n agregue un cambio donde redondeamos hacia abajo el tama\u00f1o m\u00e1ximo de escritura si el servidor negocia un valor que no es un m\u00faltiplo de 4096 ( tambi\u00e9n tenemos que comprobar que no lo redondeamos a cero)."
          }
        ],
        "id": "CVE-2024-26692",
        "lastModified": "2026-08-04T11:16:56.810",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-26692",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:53:00.719188Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-03T15:15:52.610",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:51:16+00:00",
      "cve": "CVE-2024-26692",
      "id": "CVE-2024-26692",
      "initial_release_date": "2024-04-03T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: Fix regression in writes when non-standard maximum write size negotiated",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26692.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:17:03Z",
      "cve": "CVE-2024-26692",
      "id": "CVE-2024-26692",
      "initial_release_date": "2024-04-09T02:29:12Z",
      "product_status:known_affected": "315",
      "product_status:known_not_affected": "328",
      "product_status:recommended": "624",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26692",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26692.json",
      "version": "82"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:14:12.775Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-26692",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:53:00.719188Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:17.099Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/client/connect.c",
                "fs/smb/client/fs_context.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "4145ccff546ea868428b3e0fe6818c6261b574a9",
                  "status": "affected",
                  "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
                  "versionType": "git"
                },
                {
                  "lessThan": "63c35afd50e28b49c5b75542045a8c42b696dab9",
                  "status": "affected",
                  "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
                  "versionType": "git"
                },
                {
                  "lessThan": "4860abb91f3d7fbaf8147d54782149bb1fc45892",
                  "status": "affected",
                  "version": "d08089f649a0cfb2099c8551ac47eef0cc23fdf2",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/smb/client/connect.c",
                "fs/smb/client/fs_context.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.3"
                },
                {
                  "lessThan": "6.3",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.18",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.8",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.18",
                      "versionStartIncluding": "6.3",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.6",
                      "versionStartIncluding": "6.3",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8",
                      "versionStartIncluding": "6.3",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Fix regression in writes when non-standard maximum write size negotiated\n\nThe conversion to netfs in the 6.3 kernel caused a regression when\nmaximum write size is set by the server to an unexpected value which is\nnot a multiple of 4096 (similarly if the user overrides the maximum\nwrite size by setting mount parm \"wsize\", but sets it to a value that\nis not a multiple of 4096).  When negotiated write size is not a\nmultiple of 4096 the netfs code can skip the end of the final\npage when doing large sequential writes, causing data corruption.\n\nThis section of code is being rewritten/removed due to a large\nnetfs change, but until that point (ie for the 6.3 kernel until now)\nwe can not support non-standard maximum write sizes.\n\nAdd a warning if a user specifies a wsize on mount that is not\na multiple of 4096 (and round down), also add a change where we\nround down the maximum write size if the server negotiates a value\nthat is not a multiple of 4096 (we also have to check to make sure that\nwe do not round it down to zero)."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The attacker-controlled input is the MaxWriteSize field of the SMB2 NEGOTIATE response received over TCP/445 from a remote SMB server, copied verbatim into server-\u003emax_write with no validation. A malicious/compromised server, a DFS-referral target, or an on-path attacker (MaxWriteSize is unsigned in the pre-auth NEGOTIATE and is not covered by FSCTL_VALIDATE_NEGOTIATE_INFO) supplies it purely over the network.\nAC:L - The server simply advertises a MaxWriteSize that is not a multiple of PAGE_SIZE (or zero); there is no race, no dependency on memory layout, and no condition outside the attacker\u0027s control. Every large sequential write on the mount then corrupts deterministically.\nPR:N - The attacker is the remote SMB peer and needs no credentials or privileges on the victim client; the poisoned MaxWriteSize is delivered in the NEGOTIATE response, which precedes session setup and authentication entirely.\nUI:R - The victim must mount a CIFS/SMB share from the attacker-controlled or compromised server, since wsize is fixed at mount time in cifs_mount_get_tcon(). This is minimal interaction \u2014 an /etc/fstab, autofs, or systemd automount does it with no human present \u2014 but a mount action is still required.\nS:U - The corruption and the stuck-writeback hang are confined to the mounting kernel\u0027s page cache and the mounted share, within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:L - There is no kernel-memory disclosure, but the skipped tail regions mean in-place rewrites silently fail to overwrite: residual old file content (e.g. secrets a program believed it had replaced) persists on the share and stays readable to anyone with access to the current file. The exposure is bounded to those stale tail regions, so Low rather than High.\nI:H - The remote server fully controls how much of each page is silently discarded \u2014 up to 4095 of every 4096 bytes \u2014 while write(), close(), and fsync() all report success and the page cache masks the damage until eviction, so backups, databases, config files, and source trees are corrupted undetectably. This is complete, attacker-directed loss of integrity over all data written to the mount.\nA:H - With a server-advertised MaxWriteSize of 0, wsize becomes 0 and wdata-\u003ebytes is 0, so all three completion helpers early-return on !len and never undo the unconditional folio_start_writeback(), leaving folios permanently under writeback. That yields unkillable D-state tasks on fsync/sync/truncate/umount, permanently pinned pages, and an ever-growing NR_WRITEBACK that stalls system-wide dirty-page throttling."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:26:44.270Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/4145ccff546ea868428b3e0fe6818c6261b574a9"
            },
            {
              "url": "https://git.kernel.org/stable/c/63c35afd50e28b49c5b75542045a8c42b696dab9"
            },
            {
              "url": "https://git.kernel.org/stable/c/4860abb91f3d7fbaf8147d54782149bb1fc45892"
            }
          ],
          "title": "smb: Fix regression in writes when non-standard maximum write size negotiated",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-26692",
        "datePublished": "2024-04-03T14:54:53.343Z",
        "dateReserved": "2024-02-19T14:20:24.155Z",
        "dateUpdated": "2026-08-05T11:26:44.270Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.