CVE-2026-98126

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: validate new EOF for zero range

When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE,

smb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing

the file to grow beyond the caller's file-size limit.

Fix this by calling inode_newsize_ok() before sending the zero-range

request when the operation would extend EOF.

Reproducer, using a file on a CIFS mount:

bash -c '

FILE=/mnt/cifs/repro

trap "" SIGXFSZ

ulimit -f 3072

truncate -s 2M "$FILE"

fallocate --zero-range -o 0 -l 4M "$FILE"

echo "fallocate rc=$?"

stat -c "file size=%s" "$FILE"

'

Before this change, the operation succeeds despite the 3 MiB limit:

fallocate rc=0

file size=4194304

After this change, fallocate fails and leaves the file at 2 MiB.

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References