PT-2026-98788 · Linux · Linux
CVE-2026-98126
·
Published
2026-09-25
·
Updated
2026-09-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
smb/client: validate new EOF for zero range
When FALLOC FL ZERO RANGE is used without FALLOC FL KEEP SIZE,
smb3 zero range() may extend EOF without checking RLIMIT FSIZE, allowing
the file to grow beyond the caller's file-size limit.
Fix this by calling inode newsize ok() before sending the zero-range
request when the operation would extend EOF.
Reproducer, using a file on a CIFS mount:
bash -c '
FILE=/mnt/cifs/repro
trap "" SIGXFSZ
ulimit -f 3072
truncate -s 2M "$FILE"
fallocate --zero-range -o 0 -l 4M "$FILE"
echo "fallocate rc=$?"
stat -c "file size=%s" "$FILE"
'Before this change, the operation succeeds despite the 3 MiB limit:
fallocate rc=0
file size=4194304After this change, fallocate fails and leaves the file at 2 MiB.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux