File Size Management Flaw in Linux Kernel Affecting SMB Client Operations

CVE-2026-98126

What is CVE-2026-98126?

A vulnerability exists in the Linux kernel's SMB client component, specifically linked to the handling of file size limits when using FALLOC_FL_ZERO_RANGE without FALLOC_FL_KEEP_SIZE. When this condition occurs, the function smb3_zero_range() may unintentionally extend the End of File (EOF) without adequately verifying the file size limit set by RLIMIT_FSIZE. This can lead to a situation where files grow larger than permitted by the caller's configuration, potentially compromising system integrity. The issue has been addressed by updating the function to ensure inode_newsize_ok() is called prior to any operation that would extend the EOF, thereby enforcing file size constraints effectively.

References