File Size Validation Vulnerability in Linux Kernel Affecting smb/client

CVE-2026-98127

What is CVE-2026-98127?

A vulnerability in the Linux kernel's smb/client component allows for improper validation of the end-of-file (EOF) during insertion range operations. Specifically, the function smb3_insert_range() fails to check if the new file size resulting from an insert operation exceeds system-imposed limits. This oversight can permit an operation to bypass defined file size restrictions, leading to scenarios where the file size can surpass expected boundaries. Affected users of the CIFS mount may experience situations where the file size grows beyond allowable limits, potentially leading to data corruption or affected application performance. The resolved issue ensures that size calculations are carried out properly, utilizing check_add_overflow() and validating the new size with inode_newsize_ok() before modification.

References