CVE-2026-98127

A flaw was found in the Linux kernel SMB client. The smb3_insert_range() function did not validate the new end-of-file (EOF) size before performing an FALLOC_FL_INSERT_RANGE operation on a file stored on a mounted CIFS/SMB share. A local user with write access to such a file could use fallocate(2) to bypass the RLIMIT_FSIZE process limit, exceed the filesystem's maximum file size (s_maxbytes), or produce a file size outside the valid loff_t range. Red Hat rates the impact of this flaw as Low, below the Moderate severity indicated by the CVSS:3.1 base score of 5.5, because exploitation requires local access with write permission to a file on an already-mounted SMB share and the consequence is limited to a file-size policy bypass, with no evidence of privilege escalation, kernel memory corruption, or confidentiality impact.

The kernel packages in Red Hat Enterprise Linux 6, 7, and 8, including the real-time kernel, are not affected because the vulnerable code is not present in those versions. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases based on RHEL CoreOS 9 are affected. Because this issue is rated Low impact, the fix is deferred to a future update of the affected products; the residual risk of the deferral is that a local user could bypass file-size restrictions on systems with CIFS/SMB mounts, which does not cross security boundaries.