CVE-2026-98451

What it is

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink. Track whether cifs_do_create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish_no_open() so the VFS can continue the lookup. Do not set FMODE_CREATED unless a regular file was opened. For O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's -EFTYPE check. Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails.

At a glance

Exploitability

Can be exploited over the network without logging in, but needs a user to act. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-09-25 10:25 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-10-18 16:16 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-10-30 13:21 UTC Last updatedMost recent change to the record

Details

Published

2026-10-18 16:16 UTC

Last modified

2026-10-30 13:21 UTC

Exploit probability

0.4% · EPSS, next 30 days

Record status

Received

Attack profile CVSS 3.1 · 8.8

Attack vector

Network

Complexity

Low

Privileges needed

None

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High