CVE-2026-98126

CVE CVE-2026-98126EUVD EUVD-2026-86957Published 2026-09-25T10:36:07.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE, smb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing the file to grow beyond the caller's file-size limit. Fix this by calling inode_newsize_ok() before sending the zero-range request when the operation would extend EOF. Reproducer, using a file on a CIFS mount: bash -c ' FILE=/mnt/cifs/repro trap "" SIGXFSZ ulimit -f 3072 truncate -s 2M "$FILE" fallocate --zero-range -o 0 -l 4M "$FILE" echo "fallocate rc=$?" stat -c "file size=%s" "$FILE" ' Before this change, the operation succeeds despite the 3 MiB limit: fallocate rc=0 file size=4194304 After this change, fallocate fails and leaves the file at 2 MiB.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <88972e35750792e717af287dc71f42a03b5cbce4; patch: 6.12.111; 5.1; patch: 7.3-rc2; 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <f320ca20c273a26cd779bdb2b2e4b076a95c76f6; patch: 6.18.53; 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <06a4f9049cb6dc319bceec2dc813ba89add8b828; 72c419d9b073628d3b5b0b2fc787b724f1a8c726 <3673f057b64abfa957e8ae84448db69369a5091a; patch: 0; patch: 7.2.7

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.