CVE-2026-93794 smb/client: flush dirty data before punching a hole
A flaw in the Linux kernel SMB client allows attackers to read stale data from punched holes due to improper cache flushing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93794?
CVE-2026-93794 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb/client: flush dirty data before punching a hole
Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with:
xfs_io -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h 0" \ -c "seek -d 1m" \ /mnt/test/repro
Punching 1 MiB at offset 1 MiB should produce:
0 1 MiB 2 MiB 3 MiB | DATA | HOLE | DATA | EOF
Instead, the entire file is reported as data. SEEK_HOLE(0) returns EOF, and SEEK_DATA(1M) returns 1M.
This happens because a dirty folio spanning the punched range can be written back after the punch and refill the hole.
Fix this by flushing and waiting for dirty data in the punched range before invalidating the page cache and issuing FSCTL_SET_ZERO_DATA.
The xfstests generic/539 pass against Samba/ksmbd with this change.
Which versions are affected by CVE-2026-93794?
How do I fix CVE-2026-93794?
Apply the vendor's patch.
Is CVE-2026-93794 being exploited?
There is no known exploitation of CVE-2026-93794 in the wild and no public exploit code.
Sources
Also known as AZL-103667, BELL-CVE-2026-93794, DEBIAN-CVE-2026-93794, GHSA-5fcw-5g57-rhgg, UBUNTU-CVE-2026-93794.