CVE-2026-93794
Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfs_io -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h 0" \ -c "seek -d 1m" \ /mnt/test/repro Punching 1 MiB at offset 1 MiB should produce: 0 1 MiB 2 MiB 3 MiB | DATA | HOLE | DATA | EOF Instead, the entire file is reported as data. SEEK_HOLE(0) returns EOF, and SEEK_DATA(1M) returns 1M. This happens because a dirty folio spanning the punched range can be written back after the punch and refill the hole. Fix this by flushing and waiting for dirty data in the punched range before invalidating the page cache and issuing FSCTL_SET_ZERO_DATA. The xfstests generic/539 pass against Samba/ksmbd with this change.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93794
EUVD
EUVD-2026-86181

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw where punching a hole in a file after a large buffered write may not work correctly. Dirty data in the punched range can be written back after the operation, refilling the hole and leaving the file range incorrectly reported as data instead of a hole.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and file system hole-punching behavior. Detection requires checking for inconsistent hole/data reporting in files after punching operations. Use the provided xfs_io command to reproduce and verify the issue on a test file system. No network detection commands are applicable as this is a local file system bug.

Impact Analysis

This could lead to incorrect file size reporting, data corruption, or unexpected behavior in applications relying on file hole punching. Users may experience data inconsistencies or loss if the file system incorrectly handles hole punching operations.

Mitigation Strategies

Apply the Linux kernel patch that flushes dirty data before punching holes. Update to a kernel version containing the fix. If immediate patching isn't possible, avoid using hole-punching operations on filesystems accessed via SMB until patched. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93794. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart