GHSA-5W48-8XG9-2GRF

Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 12:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

smb/client: validate new EOF for insert range

smb3_insert_range() does not check if the new file size (i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass RLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t range.

Use check_add_overflow() to calculate the new EOF. Validate it with inode_newsize_ok() before modifying the file.

Reproducer, using a file on a CIFS mount:

bash -c '
    FILE=/mnt/cifs/repro

    trap "" SIGXFSZ
    ulimit -f 3072      # RLIMIT_FSIZE = 3 MiB

    # A regular write is stopped at 3 MiB.
    dd if=/dev/zero of="$FILE" bs=1M count=4 status=none
    stat -c "size after write: %s" "$FILE"

    # Insert 2 MiB into a 2 MiB file.
    truncate -s 2M "$FILE"
    fallocate -i -o 0 -l 2M "$FILE"
    stat -c "size after insert: %s" "$FILE"
'

Before this change, the regular write stops at the 3 MiB limit, but insert range grows the file to 4 MiB:

dd: error writing '/mnt/cifs/repro': File too large
size after write: 3145728
size after insert: 4194304

After this change, insert range also fails at the limit and leaves the 2 MiB file unchanged:

dd: error writing '/mnt/cifs/repro': File too large
size after write: 3145728
fallocate: fallocate failed: File too large
size after insert: 2097152
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-98127"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T11:17:44Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: validate new EOF for insert range\n\nsmb3_insert_range() does not check if the new file size\n(i_size + len) is valid. This allows FALLOC_FL_INSERT_RANGE to bypass\nRLIMIT_FSIZE, exceed s_maxbytes, or produce a size outside the loff_t\nrange.\n\nUse check_add_overflow() to calculate the new EOF. Validate it with\ninode_newsize_ok() before modifying the file.\n\nReproducer, using a file on a CIFS mount:\n\n\tbash -c \u0027\n\t\tFILE=/mnt/cifs/repro\n\n\t\ttrap \"\" SIGXFSZ\n\t\tulimit -f 3072\t\t# RLIMIT_FSIZE = 3 MiB\n\n\t\t# A regular write is stopped at 3 MiB.\n\t\tdd if=/dev/zero of=\"$FILE\" bs=1M count=4 status=none\n\t\tstat -c \"size after write: %s\" \"$FILE\"\n\n\t\t# Insert 2 MiB into a 2 MiB file.\n\t\ttruncate -s 2M \"$FILE\"\n\t\tfallocate -i -o 0 -l 2M \"$FILE\"\n\t\tstat -c \"size after insert: %s\" \"$FILE\"\n\t\u0027\n\nBefore this change, the regular write stops at the 3 MiB limit, but\ninsert range grows the file to 4 MiB:\n\n\tdd: error writing \u0027/mnt/cifs/repro\u0027: File too large\n\tsize after write: 3145728\n\tsize after insert: 4194304\n\nAfter this change, insert range also fails at the limit and leaves the\n2 MiB file unchanged:\n\n\tdd: error writing \u0027/mnt/cifs/repro\u0027: File too large\n\tsize after write: 3145728\n\tfallocate: fallocate failed: File too large\n\tsize after insert: 2097152",
  "id": "GHSA-5w48-8xg9-2grf",
  "modified": "2026-09-25T12:31:37Z",
  "published": "2026-09-25T12:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98127"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1519dc88c87f5346dae0464d7d6da1b6bf1f6e8e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7c2c69045aa76ccaa7f16f1478eb312130ce4951"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bc7602b9082ef195d913c4c16fa9853dd262333e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f8cbfe3a3fcee7d991fd223f660f3e5df13221cf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.