In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can… (CVE-2026-98451)

The vulnerability in the Linux kernel SMB client arises when an O_CREAT open operation encounters an existing symlink or non-regular inode. The function cifs_atomic_open() incorrectly calls finish_open() and attaches a cifsFileInfo, which leaks dentry references because symlink inodes lack a CIFS release operation. Additionally, FMODE_OPENED prevents the VFS from following the symlink. The fix involves tracking whether cifs_do_create() returned an open server handle and, for non-regular inodes, closing the handle if present, removing the pending open, and calling finish_no_open() to allow the VFS to continue lookup properly. FMODE_CREATED is only set if a regular file is opened, and O_NOFOLLOW with __O_REGULAR returns -ELOOP before the VFS's -EFTYPE check. Legacy POSIX handle closing is deferred until after inode lookup to avoid double closing if lookup fails.

The vulnerability causes resource leaks (dentry references) and improper handling of non-regular inodes such as symlinks during SMB client file open operations in the Linux kernel. This can lead to incorrect filesystem behavior and potential denial of service due to leaked references and failed lookups. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by properly handling non-regular inodes during SMB client open operations. Users should apply the official kernel updates that include this patch once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation status and apply updates accordingly.