CVE-2026-98127

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: validate new EOF for insert range

smb3_insert_range() does not check if the new file size

(i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass

RLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t

range.

Use check_add_overflow() to calculate the new EOF. Validate it with

inode_newsize_ok() before modifying the file.

Reproducer, using a file on a CIFS mount:

bash -c '

FILE=/mnt/cifs/repro

trap "" SIGXFSZ

ulimit -f 3072 # RLIMIT_FSIZE = 3 MiB

# A regular write is stopped at 3 MiB.

dd if=/dev/zero of="$FILE" bs=1M count=4 status=none

stat -c "size after write: %s" "$FILE"

# Insert 2 MiB into a 2 MiB file.

truncate -s 2M "$FILE"

fallocate -i -o 0 -l 2M "$FILE"

stat -c "size after insert: %s" "$FILE"

'

Before this change, the regular write stops at the 3 MiB limit, but

insert range grows the file to 4 MiB:

dd: error writing '/mnt/cifs/repro': Fil

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References