All vulnerabilities
CVE-2026-98451

Linux: smb: client: use finish_no_open() for non-regular inodes

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in045532f920d86dd76600b635f9756e5fd671ddfcAlso 70a7918fda54a06d836acc91eb9a3c7e860fe0a0, 3c07deb26273155c180aedfd9041ab58015d2521CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 045532f920d86dd76600b635f9756e5fd671ddfcLinuxCVE List
  • 70a7918fda54a06d836acc91eb9a3c7e860fe0a0LinuxCVE List
  • 3c07deb26273155c180aedfd9041ab58015d2521LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: use finish_no_open() for non-regular inodes

An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink.

Track whether cifs_do_create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish_no_open() so the VFS can continue the lookup. Do not set FMODE_CREATED unless a regular file was opened. For O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's -EFTYPE check.

Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails.

Text from CVE List

Affected versions 12

  • Linuxaffected: d2c127197dfc0b2bae62a52e1e0d3e3ff493919e before 045532f920d86dd76600b635f9756e5fd671ddfcCVE List
  • Linuxaffected: d2c127197dfc0b2bae62a52e1e0d3e3ff493919e before ed03d547598c92a036f20e89156540995cac889aCVE List
  • Linuxaffected: d2c127197dfc0b2bae62a52e1e0d3e3ff493919e before 70a7918fda54a06d836acc91eb9a3c7e860fe0a0CVE List
  • Linuxaffected: d2c127197dfc0b2bae62a52e1e0d3e3ff493919e before 3c07deb26273155c180aedfd9041ab58015d2521CVE List
  • Linuxaffected: d2c127197dfc0b2bae62a52e1e0d3e3ff493919e before e66cf1625ec4a3fe68346119f371def713fd0a4dCVE List
  • Linuxaffected: 3.6CVE List
  • Linuxunaffected: all versions before 3.6CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5