CVE-2026-98451

Received Received - Intake

Linux Kernel Symlink Handling Flaw in SMB Client

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink. Track whether cifs_do_create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish_no_open() so the VFS can continue the lookup. Do not set FMODE_CREATED unless a regular file was opened. For O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's -EFTYPE check. Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98451

EUVD

EUVD-2026-103691

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	d2c127197dfc0b2bae62a52e1e0d3e3ff493919e
Linux	Linux	d2c127197dfc0b2bae62a52e1e0d3e3ff493919e
Linux	Linux	d2c127197dfc0b2bae62a52e1e0d3e3ff493919e
Linux	Linux	d2c127197dfc0b2bae62a52e1e0d3e3ff493919e
Linux	Linux	3.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the SMB client where an O_CREAT open operation can incorrectly handle non-regular inodes like symlinks. The issue occurs because cifs_atomic_open() uses finish_open() for these inodes, leading to a reference leak and preventing the VFS from following the symlink due to FMODE_OPENED.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS/SMB client implementation and requires kernel-level detection. There are no direct network or system commands to detect this issue as it involves a kernel patch fix. The vulnerability is resolved by ensuring the kernel uses finish_no_open() for non-regular inodes in the CIFS client code. Check if your kernel version includes the fix by examining kernel source changes or distribution updates.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by leaking dentry references, potentially leading to resource exhaustion. It may also enable bypassing symlink restrictions if exploited.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a Linux kernel issue related to file handling in SMB client operations. Compliance implications would depend on how the affected system is used in a specific environment.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the smb client vulnerability related to symlink handling and file descriptor leaks.

Hi! I’m here to help you understand CVE-2026-98451. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70