CVE-2026-93794smb/client: flush dirty data before punching a hole
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfs_io -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h 0" \ -c "seek -d 1m" \ /mnt/test/repro Punching 1 MiB at offset 1 MiB should produce: 0 1 MiB 2 MiB 3 MiB | DATA | HOLE | DATA | EOF Instead, the entire file is reported as data. SEEK_HOLE(0) returns EOF, and SEEK_DATA(1M) returns 1M. This happens because a dirty folio spanning the punched range can be written back after the punch and refill the hole. Fix this by flushing and waiting for dirty data in the punched range before invalidating the page cache and issuing FSCTL_SET_ZERO_DATA. The xfstests generic/539 pass against Samba/ksmbd with this change.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 31742c5a331766bc7df6b0d525df00c6cd20d5a6 builds before 216e469586057c29409e4ef8311d282388c6e251; 31742c5a331766bc7df6b0d525df00c6cd20d5a6 builds before 6c265aca08155e519a8f6f6071c59dff4f535f70; from 31742c5a331766bc7df6b0d525df00c6cd20d5a6 before 39562a56cdb515f6635c3e7bfe6629439b18a169; from 31742c5a331766bc7df6b0d525df00c6cd20d5a6 before d7d2adcd022baade5cab65ca492ce63421ce3a6e | CNA record |
References
- https://git.kernel.org/stable/c/216e469586057c29409e4ef8311d282388c6e251
- https://git.kernel.org/stable/c/6c265aca08155e519a8f6f6071c59dff4f535f70
- https://git.kernel.org/stable/c/39562a56cdb515f6635c3e7bfe6629439b18a169
- https://git.kernel.org/stable/c/d7d2adcd022baade5cab65ca492ce63421ce3a6e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.