CVE-2026-98451
Received
Received - Intake
Linux Kernel Symlink Handling Flaw in SMB Client
Vulnerability report for CVE-2026-98451, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: use finish_no_open() for non-regular inodes
An O_CREAT open can find an existing symlink or another non-regular
inode. cifs_atomic_open() calls finish_open() on it and attaches a
cifsFileInfo. Symlink inodes have no CIFS release operation, so the
dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also
prevents the VFS from following the symlink.
Track whether cifs_do_create() returned an open server handle. For
non-regular inodes, close the handle if present, remove the pending
open, and call finish_no_open() so the VFS can continue the lookup.
Do not set FMODE_CREATED unless a regular file was opened. For
O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's
-EFTYPE check.
Defer closing a legacy POSIX handle on a non-regular inode until
after inode lookup. This avoids closing it again if lookup fails.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | d2c127197dfc0b2bae62a52e1e0d3e3ff493919e |
| Linux | Linux | d2c127197dfc0b2bae62a52e1e0d3e3ff493919e |
| Linux | Linux | d2c127197dfc0b2bae62a52e1e0d3e3ff493919e |
| Linux | Linux | d2c127197dfc0b2bae62a52e1e0d3e3ff493919e |
| Linux | Linux | 3.6 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
