VulnerabilityPublished 25 Sep 2026Updated 21 Oct 2026

CVE-2026-98126: Linux kernel · smb/client: validate new EOF for zero range

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f320ca20c273a26cd779bdb2b2e4b076a95c76f6 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:07 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f320ca20c273a26cd779bdb2b2e4b076a95c76f6, 88972e35750792e717af287dc71f42a03b5cbce4, 3673f057b64abfa957e8ae84448db69369a5091a +2

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 72c419d9b073628d3b5b0b2fc787b724f1a8c726, < f320ca20c273a26cd779bdb2b2e4b076a95c76f6	Fixed in f320ca20c273a26cd779bdb2b2e4b076a95c76f6
LinuxLinux	Affected ≥ 72c419d9b073628d3b5b0b2fc787b724f1a8c726, < 88972e35750792e717af287dc71f42a03b5cbce4	Fixed in 88972e35750792e717af287dc71f42a03b5cbce4
LinuxLinux	Affected ≥ 72c419d9b073628d3b5b0b2fc787b724f1a8c726, < 3673f057b64abfa957e8ae84448db69369a5091a	Fixed in 3673f057b64abfa957e8ae84448db69369a5091a
LinuxLinux	Affected ≥ 72c419d9b073628d3b5b0b2fc787b724f1a8c726, < 06a4f9049cb6dc319bceec2dc813ba89add8b828	Fixed in 06a4f9049cb6dc319bceec2dc813ba89add8b828
LinuxLinux	Affected ≥ 72c419d9b073628d3b5b0b2fc787b724f1a8c726, < 5fbd8848f2e25c8163896ec52863df2305a3bb63	Fixed in 5fbd8848f2e25c8163896ec52863df2305a3bb63
LinuxLinux	Affected =5.1	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE, smb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing the file to grow beyond the caller's file-size limit. Fix this by calling inode_newsize_ok() before sending the zero-range request when the operation would extend EOF. Reproducer, using a file on a CIFS mount: bash -c ' FILE=/mnt/cifs/repro trap "" SIGXFSZ ulimit -f 3072 truncate -s 2M "$FILE" fallocate --zero-range -o 0 -l 4M "$FILE" echo "fallocate rc=$?" stat -c "file size=%s" "$FILE" ' Before this change, the operation succeeds despite the 3 MiB limit: fallocate rc=0 file size=4194304 After this change, fallocate fails and leaves the file at 2 MiB.

References

Community reviews

Loading reviews…