CVE-2026-93794

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93794", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-18T17:59:28.789Z", "datePublished": "2026-09-24T16:02:27.716Z", "dateUpdated": "2026-10-30T12:36:46.042Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:36:46.042Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: flush dirty data before punching a hole\n\nPunching a hole after a large buffered write may leave the range\nreported as data. Reproduce it with:\n\n xfs_io -f \\\n -c \"pwrite -b 3m -S 0x61 0 3m\" \\\n -c \"fpunch 1m 1m\" \\\n -c \"seek -h 0\" \\\n -c \"seek -d 1m\" \\\n /mnt/test/repro\n\nPunching 1 MiB at offset 1 MiB should produce:\n\n 0 1 MiB 2 MiB 3 MiB\n | DATA | HOLE | DATA | EOF\n\nInstead, the entire file is reported as data. SEEK_HOLE(0) returns EOF,\nand SEEK_DATA(1M) returns 1M.\n\nThis happens because a dirty folio spanning the punched range can be\nwritten back after the punch and refill the hole.\n\nFix this by flushing and waiting for dirty data in the punched range\nbefore invalidating the page cache and issuing FSCTL_SET_ZERO_DATA.\n\nThe xfstests generic/539 pass against Samba/ksmbd with this change."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "lessThan": "0c9fcab9bf1ef3516983f3de05a19c5658c7a01e", "status": "affected", "versionType": "git"}, {"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "lessThan": "216e469586057c29409e4ef8311d282388c6e251", "status": "affected", "versionType": "git"}, {"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "lessThan": "6c265aca08155e519a8f6f6071c59dff4f535f70", "status": "affected", "versionType": "git"}, {"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "lessThan": "39562a56cdb515f6635c3e7bfe6629439b18a169", "status": "affected", "versionType": "git"}, {"version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "lessThan": "d7d2adcd022baade5cab65ca492ce63421ce3a6e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "3.17", "status": "affected"}, {"version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0c9fcab9bf1ef3516983f3de05a19c5658c7a01e"}, {"url": "https://git.kernel.org/stable/c/216e469586057c29409e4ef8311d282388c6e251"}, {"url": "https://git.kernel.org/stable/c/6c265aca08155e519a8f6f6071c59dff4f535f70"}, {"url": "https://git.kernel.org/stable/c/39562a56cdb515f6635c3e7bfe6629439b18a169"}, {"url": "https://git.kernel.org/stable/c/d7d2adcd022baade5cab65ca492ce63421ce3a6e"}], "title": "smb/client: flush dirty data before punching a hole", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0c9fcab9bf1ef3516983f3de05a19c5658c7a01e", "status": "affected", "version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "versionType": "git"}, {"lessThan": "216e469586057c29409e4ef8311d282388c6e251", "status": "affected", "version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "versionType": "git"}, {"lessThan": "6c265aca08155e519a8f6f6071c59dff4f535f70", "status": "affected", "version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "versionType": "git"}, {"lessThan": "39562a56cdb515f6635c3e7bfe6629439b18a169", "status": "affected", "version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "versionType": "git"}, {"lessThan": "d7d2adcd022baade5cab65ca492ce63421ce3a6e", "status": "affected", "version": "31742c5a331766bc7df6b0d525df00c6cd20d5a6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"lessThan": "3.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: flush dirty data before punching a hole\n\nPunching a hole after a large buffered write may leave the range\nreported as data. Reproduce it with:\n\n xfs_io -f \\\n -c \"pwrite -b 3m -S 0x61 0 3m\" \\\n -c \"fpunch 1m 1m\" \\\n -c \"seek -h 0\" \\\n -c \"seek -d 1m\" \\\n /mnt/test/repro\n\nPunching 1 MiB at offset 1 MiB should produce:\n\n 0 1 MiB 2 MiB 3 MiB\n | DATA | HOLE | DATA | EOF\n\nInstead, the entire file is reported as data. SEEK_HOLE(0) returns EOF,\nand SEEK_DATA(1M) returns 1M.\n\nThis happens because a dirty folio spanning the punched range can be\nwritten back after the punch and refill the hole.\n\nFix this by flushing and waiting for dirty data in the punched range\nbefore invalidating the page cache and issuing FSCTL_SET_ZERO_DATA.\n\nThe xfstests generic/539 pass against Samba/ksmbd with this change."}], "id": "CVE-2026-93794", "lastModified": "2026-10-30T13:21:02.940", "metrics": {}, "published": "2026-09-24T17:17:12.160", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0c9fcab9bf1ef3516983f3de05a19c5658c7a01e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/216e469586057c29409e4ef8311d282388c6e251"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/39562a56cdb515f6635c3e7bfe6629439b18a169"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c265aca08155e519a8f6f6071c59dff4f535f70"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d7d2adcd022baade5cab65ca492ce63421ce3a6e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb/client: flush dirty data before punching a hole", "id": "2540526", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540526"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-820", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb/client: flush dirty data before punching a hole\nPunching a hole after a large buffered write may leave the range\nreported as data. Reproduce it with:\nxfs_io -f \\\n-c \"pwrite -b 3m -S 0x61 0 3m\" \\\n-c \"fpunch 1m 1m\" \\\n-c \"seek -h 0\" \\\n-c \"seek -d 1m\" \\\n/mnt/test/repro\nPunching 1 MiB at offset 1 MiB should produce:\n0 1 MiB 2 MiB 3 MiB\n| DATA | HOLE | DATA | EOF\nInstead, the entire file is reported as data. SEEK_HOLE(0) returns EOF,\nand SEEK_DATA(1M) returns 1M.\nThis happens because a dirty folio spanning the punched range can be\nwritten back after the punch and refill the hole.\nFix this by flushing and waiting for dirty data in the punched range\nbefore invalidating the page cache and issuing FSCTL_SET_ZERO_DATA.\nThe xfstests generic/539 pass against Samba/ksmbd with this change.", "A flaw was found in the Linux kernel's SMB (Server Message Block) client. A local user can cause data corruption when performing hole-punching operations on a mounted SMB share. Because dirty memory pages are not flushed prior to punching a hole, uncommitted cached data can subsequently be written back to the file and refill the punched region. This issue results in data unexpectedly persisting instead of being cleared and deallocated."], "name": "CVE-2026-93794", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93794\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93794\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93794.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6c265aca08155e519a8f6f6071c59dff4f535f70)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,39562a56cdb515f6635c3e7bfe6629439b18a169)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d7d2adcd022baade5cab65ca492ce63421ce3a6e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T21:30:17.072899+00:00", "updated": "2026-10-01T20:15:12.382776+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-820"]}