UBUNTU-CVE-2026-98126: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange() may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix this by calling inodenewsizeok() before sending the zero-range request when the operation would extend EOF. Reproducer, using a file on a CIFS mount: bash -c ' FILE=/mnt/cifs/repro trap "" SIGXFSZ ulimit -f 3072 truncate -s 2M "$FILE" fallocate --zero-range -o 0 -l 4M "$FILE" echo "fallocate rc=$?" stat -c "file size=%s" "$FILE" ' Before this change, the operation succeeds despite the 3 MiB limit: fallocate rc=0 file size=4194304 After this change, fallocate fails and leaves the file at 2 MiB.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In smb3_zero_range(), call inode_newsize_ok() before sending the zero-range request when FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE and the operation would extend EOF.
Event History
Frequently Asked Questions
Who is affected in practice?
The issue affects processes operating on files on a CIFS mount through the SMB client when they use FALLOC_FL_ZERO_RANGE without FALLOC_FL_KEEP_SIZE and the operation extends the file past its current EOF. The listed Ubuntu Linux kernel packages include linux, linux-azure, linux-gcp, linux-aws-fips, linux-fips, linux-azure-fips, linux-gcp-fips, and linux-realtime.
What access does an attacker need to exploit this?
An attacker needs local access as a user able to operate on a file on a CIFS-mounted filesystem. They must be able to invoke a zero-range fallocate operation that extends EOF; no user interaction is required.
How can I determine whether a system is vulnerable?
On a CIFS mount, set a file-size limit, create a file smaller than that limit, and use fallocate --zero-range without keeping size to extend it beyond the limit. The supplied reproducer uses a 3 MiB limit and a 2 MiB file; an affected kernel allows it to grow to 4 MiB, while a fixed kernel fails the operation and leaves the file at 2 MiB.
What is the impact of successful exploitation?
A local process can bypass its RLIMIT_FSIZE restriction for this specific SMB zero-range operation, causing a CIFS-hosted file to grow beyond the caller's configured file-size limit. The provided severity vector indicates low integrity and availability impact, with no confidentiality impact.