UBUNTU-CVE-2026-93794: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h 0" \ -c "seek -d 1m" \ /mnt/test/repro Punching 1 MiB at offset 1 MiB should produce: 0 1 MiB 2 MiB 3 MiB | DATA | HOLE | DATA | EOF Instead, the entire file is reported as data. SEEKHOLE(0) returns EOF, and SEEKDATA(1M) returns 1M. This happens because a dirty folio spanning the punched range can be written back after the punch and refill the hole. Fix this by flushing and waiting for dirty data in the punched range before invalidating the page cache and issuing FSCTLSETZERODATA. The xfstests generic/539 pass against Samba/ksmbd with this change.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel SMB client, flush and wait for dirty data in the punched range before invalidating the page cache and issuing FSCTL_SET_ZERO_DATA.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the affected Ubuntu Linux kernel packages with SMB client workloads are exposed when they perform hole punching on files after large buffered writes. The issue is relevant to Ubuntu linux, linux-fips, and the listed AWS, Azure, and GCP kernel variants.
What conditions are needed to trigger the problem?
A local process must be able to write to a file through the SMB client and punch a hole in a range that overlaps dirty buffered data. A dirty folio spanning the punched range can later be written back and refill the intended hole.
How can administrators tell whether they are affected?
After a large buffered write followed by a hole punch, query the file with SEEK_HOLE and SEEK_DATA. An affected system can report the whole file as data: SEEK_HOLE from offset 0 returns EOF and SEEK_DATA at the punched 1 MiB offset returns that same offset.
What can be done if updating is not immediately possible?
Avoid punching holes in SMB client files while overlapping buffered writes remain dirty. Ensure dirty data in the range is flushed and writeback has completed before performing the hole punch.