The Linux kernel’s SMB client handling of the FALLOC_FL_INSERT_RANGE operation in smb3_insert_range() fails to validate that the new file length (original size plus inserted length) remains within limits such as RLIMIT_FSIZE, s_maxbytes, or the loff_t range. Because this check is missing, an attacker can continuously insert data into a file until it exceeds system quotas or overflows internal kernel structures. This produces a denial‑of‑service situation where file operations fail or the file system becomes inconsistent, potentially exposing the system to further compromise if the overflow can be exploited to corrupt kernel memory.

All Linux kernel configurations that mount CIFS/SMB file systems—including any distribution’s kernel that includes the SMB client module—are affected. No specific vendor product versions are listed; the bug applies to any kernel revision before the fix was merged. The vulnerability manifests when an SMB share is reachable by a process that can execute the FALLOC_FL_INSERT_RANGE operation.

The EPSS score is not available and the vulnerability is not listed in KEV, so the current exploitation probability is unknown from public metrics. Because the flaw can be triggered by any user with write access to an SMB share, the exploitability is moderate, relying on normal file‑write capabilities. The impact is primarily denial of service and resource exhaustion; attackers can scale a file beyond RLIMIT_FSIZE or the kernel’s maximum file size, leading to application failure or kernel crashes. The lack of a public exploit does not reduce the risk, as the required inputs are simple and widely available.