Data Reporting Issue in Linux Kernel: SMB Client Flush Vulnerability
Summary
DEBIAN-CVE-2026-93794: In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including file systems, process management, and network protocols. This vulnerability specifically affects the SMB client, which is used for file sharing and network communication. The issue arises when dirty data is not properly flushed before a hole is punched in a file, leading to incorrect data reporting.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the SMB client where flushing dirty data before punching a hole is not performed correctly. This can result in a situation where a range of data that should be reported as a hole is instead reported as valid data. The vulnerability occurs after a large buffered write operation, where the system fails to accurately reflect the file's state. This can lead to data integrity issues, as operations like SEEK_HOLE and SEEK_DATA may return incorrect results, potentially causing confusion and errors in applications relying on accurate file state.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate any risks associated with this issue.
Conclusion
The vulnerability in the Linux kernel's SMB client poses a risk of incorrect data reporting due to improper flushing of dirty data before punching holes in files. Users are encouraged to update to the patched version to ensure data integrity and system reliability.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves incorrect data reporting in the Linux kernel's SMB client when flushing dirty data before punching a hole in a file.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The main consequence is the risk of data integrity issues, where applications may receive incorrect information about file states, leading to possible errors in data handling.
Yes, a patch is available for Debian 14 in version 7.2.6-1. Users should update their Linux kernel to this version to fix the vulnerability.
While there are no specific workarounds, it is advisable to monitor your system closely for any unusual behavior and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
