CVE-2026-98451

smb: client: use finish_no_open() for non-regular inodes

State: Published
Severity: 8.8 High
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: use finish_no_open() for non-regular inodes

An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink.

Track whether cifs_do_create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish_no_open() so the VFS can continue the lookup. Do not set FMODE_CREATED unless a regular file was opened. For O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's -EFTYPE check.

Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before bc585d5a381ab49cb611c35dda93a997214ca874Affected d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 26f4bca335e719e291995e28dc434de0145a6a54Affected d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 51c7b0593f6eaba05349fd2a01a9cb4df7d7412fAffected d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 045532f920d86dd76600b635f9756e5fd671ddfcAffected d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before ed03d547598c92a036f20e89156540995cac889aAffected d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 70a7918fda54a06d836acc91eb9a3c7e860fe0a0Affected d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 3c07deb26273155c180aedfd9041ab58015d2521Affected d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before e66cf1625ec4a3fe68346119f371def713fd0a4dAffected
LinuxLinux	3.6Affected before 3.6Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before bc585d5a381ab49cb611c35dda93a997214ca874Affected
d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 26f4bca335e719e291995e28dc434de0145a6a54Affected
d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 51c7b0593f6eaba05349fd2a01a9cb4df7d7412fAffected
d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 045532f920d86dd76600b635f9756e5fd671ddfcAffected
d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before ed03d547598c92a036f20e89156540995cac889aAffected
d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 70a7918fda54a06d836acc91eb9a3c7e860fe0a0Affected
d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before 3c07deb26273155c180aedfd9041ab58015d2521Affected
d2c127197dfc0b2bae62a52e1e0d3e3ff493919e to before e66cf1625ec4a3fe68346119f371def713fd0a4dAffected

LinuxLinux

3.6Affected
before 3.6Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.