In the Linux kernel, the absence of a size limit check when using FALLOC_FL_ZERO_RANGE on SMB/CIFS mounts can cause the kernel to extend a file’s end of file (EOF) beyond the caller’s RLIMIT_FSIZE, allowing a file to grow past the user‑defined size limit. The primary impact is a bypass of file size restrictions, which can lead to resource exhaustion, violation of quota policies, and potential denial of service if large files are written without permission.

This flaw affects the Linux kernel when the SMB client (smb3) performs a zero‑range allocate on a CIFS share. No specific kernel releases are listed, but the issue applies to any system running a Linux kernel with the SMB3 client enabled and using FALLOC_FL_ZERO_RANGE. It is relevant to deployments that mount Windows shares via CIFS and rely on zero‑range support.

The vulnerability is not listed in CISA KEV and its EPSS score is less than 1%, indicating limited public exploitation data. The CVSS score of 5.5 reflects a moderate severity impact. The flaw requires the ability to issue a fallocate call that uses FALLOC_FL_ZERO_RANGE on a CIFS mount, so local or remote access that can write to the share is necessary. Once those conditions are met, the attacker can cause a file to grow beyond the user’s size limit, potentially consuming disk space or violating quota enforcement. The lack of exploitation evidence and the need for privileged operations suggest a moderate risk in environments where users have write access to CIFS shares.