CVE-2026-98127

A flaw was found in the Linux kernel's SMB client. The smb3_insert_range function does not properly validate the resulting file size when inserting a range of space into an existing file on a mounted share. A local user can exploit this flaw using a fallocate request to bypass configured file size limits (RLIMIT_FSIZE) or exceed maximum filesystem boundaries.

A flaw was found in the Linux kernel SMB client. The smb3_insert_range() function did not validate the new end-of-file (EOF) size before performing an FALLOC_FL_INSERT_RANGE operation on a file stored on a mounted CIFS/SMB share. A local user with write access to such a file could use fallocate(2) to bypass the RLIMIT_FSIZE process limit, exceed the filesystem's maximum file size (s_maxbytes), or produce a file size outside the valid loff_t range. Red Hat rates the impact of this flaw as Low, below the Moderate severity indicated by the CVSS:3.1 base score of 5.5, because exploitation requires local access with write permission to a file on an already-mounted SMB share and the consequence is limited to a file-size policy bypass, with no evidence of privilege escalation, kernel memory corruption, or confidentiality impact.

The kernel packages in Red Hat Enterprise Linux 6, 7, and 8, including the real-time kernel, are not affected because the vulnerable code is not present in those versions. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases based on RHEL CoreOS 9 are affected. Because this issue is rated Low impact, the fix is deferred to a future update of the affected products; the residual risk of the deferral is that a local user could bypass file-size restrictions on systems with CIFS/SMB mounts, which does not cross security boundaries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.