---
id: CVE-2026-98451
title: 'smb: client: use finish_no_open() for non-regular inodes'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: use finish_no_open() for non-regular inodes

  An O_CREAT open can find an existing symlink or another non-regular
  inode. cifs_atomic_open() calls finish_ope…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d2c127197dfc0b2bae62a52e1e0d3e3ff493919e <
    ed03d547598c92a036f20e89156540995cac889a
  - >-
    Linux >= d2c127197dfc0b2bae62a52e1e0d3e3ff493919e <
    70a7918fda54a06d836acc91eb9a3c7e860fe0a0
  - >-
    Linux >= d2c127197dfc0b2bae62a52e1e0d3e3ff493919e <
    3c07deb26273155c180aedfd9041ab58015d2521
  - >-
    Linux >= d2c127197dfc0b2bae62a52e1e0d3e3ff493919e <
    e66cf1625ec4a3fe68346119f371def713fd0a4d
  - Linux 3.6
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:15:01.473Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98451'
references:
  - url: 'https://git.kernel.org/stable/c/ed03d547598c92a036f20e89156540995cac889a'
  - url: 'https://git.kernel.org/stable/c/70a7918fda54a06d836acc91eb9a3c7e860fe0a0'
  - url: 'https://git.kernel.org/stable/c/3c07deb26273155c180aedfd9041ab58015d2521'
  - url: 'https://git.kernel.org/stable/c/e66cf1625ec4a3fe68346119f371def713fd0a4d'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.305Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: use finish_no_open() for non-regular inodes

An O_CREAT open can find an existing symlink or another non-regular
inode. cifs_atomic_open() calls finish_open() on it and attaches a
cifsFileInfo. Symlink inodes have no CIFS release operation, so the
dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also
prevents the VFS from following the symlink.

Track whether cifs_do_create() returned an open server handle. For
non-regular inodes, close the handle if present, remove the pending
open, and call finish_no_open() so the VFS can continue the lookup.
Do not set FMODE_CREATED unless a regular file was opened. For
O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's
-EFTYPE check.

Defer closing a legacy POSIX handle on a non-regular inode until
after inode lookup. This avoids closing it again if lookup fails.

## Affected

- `Linux >= d2c127197dfc0b2bae62a52e1e0d3e3ff493919e < ed03d547598c92a036f20e89156540995cac889a`
- `Linux >= d2c127197dfc0b2bae62a52e1e0d3e3ff493919e < 70a7918fda54a06d836acc91eb9a3c7e860fe0a0`
- `Linux >= d2c127197dfc0b2bae62a52e1e0d3e3ff493919e < 3c07deb26273155c180aedfd9041ab58015d2521`
- `Linux >= d2c127197dfc0b2bae62a52e1e0d3e3ff493919e < e66cf1625ec4a3fe68346119f371def713fd0a4d`
- `Linux 3.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.