All vulnerabilities
CVE-2026-93794

Linux: smb/client: flush dirty data before punching a hole

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in216e469586057c29409e4ef8311d282388c6e251Also 6c265aca08155e519a8f6f6071c59dff4f535f70, 39562a56cdb515f6635c3e7bfe6629439b18a169CVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 216e469586057c29409e4ef8311d282388c6e251LinuxCVE List
  • 6c265aca08155e519a8f6f6071c59dff4f535f70LinuxCVE List
  • 39562a56cdb515f6635c3e7bfe6629439b18a169LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: flush dirty data before punching a hole

Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with:

xfs_io -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h 0" \ -c "seek -d 1m" \ /mnt/test/repro

Punching 1 MiB at offset 1 MiB should produce:

0 1 MiB 2 MiB 3 MiB | DATA | HOLE | DATA | EOF

Instead, the entire file is reported as data. SEEK_HOLE(0) returns EOF, and SEEK_DATA(1M) returns 1M.

This happens because a dirty folio spanning the punched range can be written back after the punch and refill the hole.

Fix this by flushing and waiting for dirty data in the punched range before invalidating the page cache and issuing FSCTL_SET_ZERO_DATA.

The xfstests generic/539 pass against Samba/ksmbd with this change.

Text from CVE List

Affected versions 10

  • Linuxaffected: 31742c5a331766bc7df6b0d525df00c6cd20d5a6 before 216e469586057c29409e4ef8311d282388c6e251CVE List
  • Linuxaffected: 31742c5a331766bc7df6b0d525df00c6cd20d5a6 before 6c265aca08155e519a8f6f6071c59dff4f535f70CVE List
  • Linuxaffected: 31742c5a331766bc7df6b0d525df00c6cd20d5a6 before 39562a56cdb515f6635c3e7bfe6629439b18a169CVE List
  • Linuxaffected: 31742c5a331766bc7df6b0d525df00c6cd20d5a6 before d7d2adcd022baade5cab65ca492ce63421ce3a6eCVE List
  • Linuxaffected: 3.17CVE List
  • Linuxunaffected: all versions before 3.17CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4