In the Linux kernel’s SMB client module, a flaw allows a hole punch operation to be followed by a write‑back of dirty pages that span the punched range. When a large buffered write precedes the hole punch, the kernel may flush dirty data after the hole is created, refilling the hole with data. This results in file system queries such as SEEK_HOLE and SEEK_DATA reporting the entire file as containing data, instead of recognising a hole. As a consequence, data that was intended to be erased remains present and can be read by user‑space programs, leading to unintentional information exposure and a data‑integrity issue.

All Linux kernel releases before the fix in commit 39562a56cdb515f6635c3e7bfe6629439b18a169 are affected. The vulnerability resides in the SMB client’s handling of punched holes, so any system running those kernel versions—including most mainstream distributions—may be impacted. The fix is incorporated at the kernel level, so updating to a kernel build containing the mentioned commit protects all affected users.

The advisory lists a CVSS score of 5.5 and an EPSS score of less than 1 %, indicating a moderate severity but very low exploitation probability. The scenario requires the attacker to perform a large buffered write followed by a punch‑hole operation on a file they can access, which generally implies local or privileged file access rather than a remote attack vector. No known public exploits exist and the vulnerability is not included in CISA’s KEV catalog, further suggesting that exploitation risk is low in the wild.