The Linux kernel’s SMB client incorrectly handles the FALLOC_FL_INSERT_RANGE operation. The smb3_insert_range() function does not verify that the new file size (original size plus the inserted length) stays within limits such as "RLIMIT_FSIZE", s_maxbytes, or the loff_t range. Because this check is missing, an attacker can insert data until the file exceeds the allowed size, causing the operation to fail and creating a denial‑of‑service scenario. The vulnerability does not provide a direct path to arbitrary code execution or memory corruption. Based on the description, it is inferred that the likely attack vector is through a writable SMB share that invokes FALLOC_FL_INSERT_RANGE.

All Linux kernel configurations that mount CIFS/SMB shares—and that include the SMB client module—are affected. The flaw exists in any kernel revision before the fix was merged; no specific vendor or distribution version is singled out. The issue manifests when the FALLOC_FL_INSERT_RANGE operation is performed on a file located on an SMB share accessible to an attacker.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of <1% shows a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires only normal file‑write privileges to an SMB share, making the exploitation condition relatively easy for an adversary who can reach a writable share. The primary impact is service disruption due to file size limit bypass, potentially leading to application errors or system instability.