EUVD-2026-86957
GHSA-788x-356f-432m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal user on host with CIFS mount
-
ExploitCall fallocate zero-range extending EOF
-
ImpactFile grows past RLIMIT_FSIZE, storage/quota exhaustion
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires: (1) an SMB3/CIFS share mounted on the host; (2) a local user with write access to a file on that mount; (3) the user invoking fallocate with FALLOC_FL_ZERO_RANGE and WITHOUT FALLOC_FL_KEEP_SIZE; and (4) the requested range extending the file's EOF beyond the caller's configured RLIMIT_FSIZE. LIMITING FACTORS: exploitation is local-only (AV:L) and requires an authenticated local account with write access (PR:L) - not remotely reachable; it is irrelevant on hosts with no CIFS mount, and only matters where RLIMIT_FSIZE limits are actually enforced as a policy control. Impact is confined to availability/resource-limit bypass; no confidentiality or integrity consequence. |
| Impact | This is a genuinely low-priority issue despite the 5.5 (MEDIUM) CVSS. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) describes a locally-exploitable, low-privilege flaw with no confidentiality or integrity impact - purely an availability/resource concern, consistent with CWE-770 (allocation of resources without limits) and the 'Denial Of Service' tag. All exploitation signals point to low real-world urgency: EPSS is only 0.17% (5th percentile), the CVE is NOT in CISA KEV, and the vuln.today decision label is 'this_month' rather than act_now/emergency. The one caveat is the A:H rating: the actual described impact is a bypass of the per-process RLIMIT_FSIZE file-size limit on files residing on an SMB3/CIFS mount, which is a policy/quota bypass leading to possible storage exhaustion - this is partial availability degradation rather than a total system outage, so the NVD A:H appears somewhat inflated for what is described. No active exploitation and no evidence of widespread targeting; this is a correctness/hardening fix, not an emergency. |
| Exploit ScenarioDerived | A local, authenticated user on a host with an SMB3/CIFS share mounted calls fallocate with FALLOC_FL_ZERO_RANGE (without FALLOC_FL_KEEP_SIZE) on a file on that mount, specifying an offset/length that extends EOF beyond their RLIMIT_FSIZE limit. The kernel's smb3_zero_range() performed no inode_newsize_ok() / RLIMIT_FSIZE check before the fix, so the file grows past the administratively-enforced size limit, enabling quota/limit bypass and potential storage exhaustion on the share. The CVE description includes a bash reproducer demonstrating the limit bypass; this is a trigger reproducer, not verified weaponized exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Linux kernel SMB client mishandles FALLOC_FL_ZERO_RANGE on CIFS/SMB3 mounts: when the zero-range request would extend a file's EOF and FALLOC_FL_KEEP_SIZE is not set, smb3_zero_range() does not validate the new size against RLIMIT_FSIZE, so a local user with write access can grow a file past the caller's file-size limit. This is a local-only, authenticated availability/resource-limit bypass; it is irrelevant without a CIFS/SMB3 mount and has low EPSS (0.17%). No public exploit was identified at time of analysis, and the issue is not in CISA KEV.
RemediationAI
Vendor-released patch: update to Linux 6.12.111, 6.18.53, 7.2.7, or 7.3-rc2, depending on the stable branch; the corresponding fixes are the git.kernel.org stable commits referenced for this CVE (for example https://git.kernel.org/stable/c/3673f057b64abfa957e8ae84448db69369a5091a and https://git.kernel.org/stable/c/06a4f9049cb6dc319bceec2dc813ba89add8b828), with the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98126. No separate vendor-documented workaround is given; because exploitation requires a local account with write access to a file on a mounted CIFS/SMB3 share, limiting such access and avoiding zero-range operations that extend EOF on those mounts reduces exposure until the kernel can be updated, but the kernel fix is the complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is in the Linux kernel SMB/CIFS client's smb3_zero_range() handling of fallocate(2) with FALLOC_FL_ZERO_RANGE but without FALLOC_FL_KEEP_SIZE. That combination can move EOF; the client sends the zero-range request without first calling inode_newsize_ok(), so the operation can exceed the caller's RLIMIT_FSIZE. The CWE-770 resource-allocation class matches the impact: an authenticated local user can allocate file space beyond an intended limit on an SMB3/CIFS mount. The supplied CPE identifies linux:linux; EUVD lists Linux 5.1 and commit-bounded ranges starting at 72c419d9b073628d3b5b0b2fc787b724f1a8c726, with fixes in the stable commits referenced.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local authenticated user with write access to a CIFS mount (AV:L/PR:L/AC:L); impact is an RLIMIT_FSIZE bypass causing partial resource/availability loss (A:L), with no C/I impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
smb/client: validate new EOF for zero range
When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE, smb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing the file to grow beyond the caller's file-size limit.
Fix this by calling inode_newsize_ok() before sending the zero-range request when the operation would extend EOF.
Reproducer, using a file on a CIFS mount:
bash -c ' FILE=/mnt/cifs/repro
trap "" SIGXFSZ ulimit -f 3072
truncate -s 2M "$FILE" fallocate --zero-range -o 0 -l 4M "$FILE" echo "fallocate rc=$?" stat -c "file size=%s" "$FILE" '
Before this change, the operation succeeds despite the 3 MiB limit:
fallocate rc=0 file size=4194304
After this change, fallocate fails and leaves the file at 2 MiB.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB