CVE-2026-98126

Undergoing Analysis Undergoing Analysis - In Progress

File Size Limit Bypass in Linux Kernel SMB Client

Publication date: 2026-09-25

Last updated on: 2026-10-22

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE, smb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing the file to grow beyond the caller's file-size limit. Fix this by calling inode_newsize_ok() before sending the zero-range request when the operation would extend EOF. Reproducer, using a file on a CIFS mount: bash -c ' FILE=/mnt/cifs/repro trap "" SIGXFSZ ulimit -f 3072 truncate -s 2M "$FILE" fallocate --zero-range -o 0 -l 4M "$FILE" echo "fallocate rc=$?" stat -c "file size=%s" "$FILE" ' Before this change, the operation succeeds despite the 3 MiB limit: fallocate rc=0 file size=4194304 After this change, fallocate fails and leaves the file at 2 MiB.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-22

Generated

2026-11-08

AI Q&A

2026-09-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98126

EUVD

EUVD-2026-86957

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.2.7 (exc)
linux	linux_kernel	7.3
linux	linux_kernel	From 6.13 (inc) to 6.18.53 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.111 (exc)
linux	linux_kernel	From 5.1 (inc) to 6.6.160 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the SMB client's handling of the FALLOC_FL_ZERO_RANGE operation. When this operation is used without FALLOC_FL_KEEP_SIZE, it can extend the end-of-file (EOF) marker without checking the user's file-size limit (RLIMIT_FSIZE). This allows a file to grow beyond the allowed size, bypassing restrictions.

Detection Guidance

To detect this vulnerability, check if the Linux kernel allows file size growth beyond RLIMIT_FSIZE when using FALLOC_FL_ZERO_RANGE without FALLOC_FL_KEEP_SIZE. Run the provided reproducer on a CIFS mount to verify if the file size exceeds the ulimit. Example command: fallocate --zero-range -o 0 -l 4M /mnt/cifs/testfile. If the operation succeeds despite ulimit restrictions, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker or a misconfigured application to bypass file-size limits, causing files to grow beyond intended or permitted sizes. This might lead to disk space exhaustion or unexpected behavior in applications relying on file-size limits.

Compliance Impact

This vulnerability allows a file to exceed the caller's file-size limit by bypassing RLIMIT_FSIZE checks when using FALLOC_FL_ZERO_RANGE without FALLOC_FL_KEEP_SIZE. This could lead to unauthorized data growth, potentially violating data integrity and storage policies required by GDPR and HIPAA.

Mitigation Strategies

Apply the kernel patch that adds inode_newsize_ok() validation before extending EOF in smb3_zero_range(). Update to a fixed Linux kernel version. If patching is not immediately possible, restrict access to CIFS mounts or monitor fallocate operations on such filesystems.

Hi! I’m here to help you understand CVE-2026-98126. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...