---
id: CVE-2026-98126
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb/client: validate new EOF for zero range

  When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE,
  smb3_zero_range() may extend EOF without checking RLIMIT_FSI…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb/client: validate new EOF for zero range

  When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE,
  smb3_zero_range() may extend EOF without checking RLIMIT_FSI…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <
    3673f057b64abfa957e8ae84448db69369a5091a
  - >-
    Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <
    06a4f9049cb6dc319bceec2dc813ba89add8b828
  - >-
    Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <
    f320ca20c273a26cd779bdb2b2e4b076a95c76f6
  - >-
    Linux >= 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <
    88972e35750792e717af287dc71f42a03b5cbce4
  - Linux 5.1
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:43.940'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98126'
references:
  - url: 'https://git.kernel.org/stable/c/06a4f9049cb6dc319bceec2dc813ba89add8b828'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3673f057b64abfa957e8ae84448db69369a5091a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/88972e35750792e717af287dc71f42a03b5cbce4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f320ca20c273a26cd779bdb2b2e4b076a95c76f6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.814Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb/client: validate new EOF for zero range

When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE,
smb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing
the file to grow beyond the caller's file-size limit.

Fix this by calling inode_newsize_ok() before sending the zero-range
request when the operation would extend EOF.

Reproducer, using a file on a CIFS mount:

	bash -c '
	        FILE=/mnt/cifs/repro

	        trap "" SIGXFSZ
	        ulimit -f 3072

	        truncate -s 2M "$FILE"
	        fallocate --zero-range -o 0 -l 4M "$FILE"
	        echo "fallocate rc=$?"
	        stat -c "file size=%s" "$FILE"
	'

Before this change, the operation succeeds despite the 3 MiB limit:

	fallocate rc=0
	file size=4194304

After this change, fallocate fails and leaves the file at 2 MiB.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.