CVE-2026-98126
Received Received - Intake

File Size Limit Bypass in Linux Kernel SMB Client

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE, smb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing the file to grow beyond the caller's file-size limit. Fix this by calling inode_newsize_ok() before sending the zero-range request when the operation would extend EOF. Reproducer, using a file on a CIFS mount: bash -c ' FILE=/mnt/cifs/repro trap "" SIGXFSZ ulimit -f 3072 truncate -s 2M "$FILE" fallocate --zero-range -o 0 -l 4M "$FILE" echo "fallocate rc=$?" stat -c "file size=%s" "$FILE" ' Before this change, the operation succeeds despite the 3 MiB limit: fallocate rc=0 file size=4194304 After this change, fallocate fails and leaves the file at 2 MiB.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98126
EUVD
EUVD-2026-86957

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the SMB client's handling of the FALLOC_FL_ZERO_RANGE operation. When this operation is used without FALLOC_FL_KEEP_SIZE, it can extend the end-of-file (EOF) marker without checking the user's file-size limit (RLIMIT_FSIZE). This allows a file to grow beyond the allowed size, bypassing restrictions.

Detection Guidance

To detect this vulnerability, check if the Linux kernel allows file size growth beyond RLIMIT_FSIZE when using FALLOC_FL_ZERO_RANGE without FALLOC_FL_KEEP_SIZE. Run the provided reproducer on a CIFS mount to verify if the file size exceeds the ulimit. Example command: fallocate --zero-range -o 0 -l 4M /mnt/cifs/testfile. If the operation succeeds despite ulimit restrictions, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker or a misconfigured application to bypass file-size limits, causing files to grow beyond intended or permitted sizes. This might lead to disk space exhaustion or unexpected behavior in applications relying on file-size limits.

Mitigation Strategies

Apply the kernel patch that adds inode_newsize_ok() validation before extending EOF in smb3_zero_range(). Update to a fixed Linux kernel version. If patching is not immediately possible, restrict access to CIFS mounts or monitor fallocate operations on such filesystems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98126. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart