{"id":"CVE-2026-98451","kind":"vulnerability","aliases":["CVE-2026-98451"],"related":[],"title":"Linux kernel SMB client: symlink open leaks a dentry reference","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: use finish_no_open() for non-regular inodes\n\nAn O_CREAT open can find an existing symlink or another non-regular\ninode. cifs_atomic_open() calls finish_open() on it and attaches a\ncifsFileInfo. Symlink inodes have no CIFS release operation, so the\ndentry reference held by cifsFileInfo is leaked. FMODE_OPENED also\nprevents the VFS from following the symlink.\n\nTrack whether cifs_do_create() returned an open server handle. For\nnon-regular inodes, close the handle if present, remove the pending\nopen, and call finish_no_open() so the VFS can continue the lookup.\nDo not set FMODE_CREATED unless a regular file was opened. For\nO_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's\n-EFTYPE check.\n\nDefer closing a legacy POSIX handle on a non-regular inode until\nafter inode lookup. This avoids closing it again if lookup fails.","summary":"When an O_CREAT open in the Linux kernel SMB client finds an existing symlink or other non-regular inode, it attaches a file handle with no release operation, leaking a dentry reference and stopping the VFS from following the symlink. The sources do not state a direct attacker impact beyond the reference leak and symlink-following change.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","linux-kernel","package","smb-client"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:16:55+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:23+00:00","updated_at":"2026-10-25T05:27:23+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T05:27:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel SMB client: symlink open leaks a dentry reference","impact":"low","summary":"When an O_CREAT open in the Linux kernel SMB client finds an existing symlink or other non-regular inode, it attaches a file handle with no release operation, leaking a dentry reference and stopping the VFS from following the symlink. The sources do not state a direct attacker impact beyond the reference leak and symlink-following change.","category":"package","nicknames":[],"who_cares":["linux-kernel","smb-client","cifs"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; reference leak and symlink handling bug in kernel","analyst_note":"Check the upstream kernel commit and NVD entry for affected kernel versions, fixed versions, and whether the symlink-following bypass has a security impact.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000549,"input_tokens":3564,"output_tokens":386,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98451':13A,16A 'also':151C 'anoth':116C 'atom':122C 'attach':47B,130C 'attack':74B 'avoid':237C 'beyond':76B 'call':124C,184C 'chang':84B 'check':219C 'cif':17B,121C,137C,161C 'cifsfileinfo':132C,146C 'client':4A,24B,35B,96C 'close':174C,221C,238C 'continu':192C 'creat':28B,108C,163C,199C 'cve':11A,14A 'defer':220C 'dentri':9A,57B,142C 'direct':73B 'eftyp':218C 'eloop':213C 'exist':38B,113C 'fail':243C 'file':49B,203C 'find':36B,111C 'finish':98C,125C,185C 'fmode':149C,198C 'follow':64B,83B,90C,156C 'handl':50B,168C,176C,225C 'held':144C 'impact':75B 'inod':45B,105C,120C,134C,173C,231C,234C 'kernel':2A,20B,33B,88C 'leak':7A,55B,79B,148C 'legaci':223C 'linux':1A,19B,32B,87C 'linux-kernel':18B 'lookup':194C,235C,242C 'nofollow':208C 'non':43B,103C,118C,171C,229C 'non-regular':42B,102C,117C,170C,228C 'o':27B,107C,207C,210C 'open':6A,29B,100C,109C,123C,126C,150C,166C,182C,187C,205C 'oper':54B,139C 'packag':21B 'pend':181C 'posix':224C 'present':178C 'prevent':152C 'refer':10A,58B,78B,143C 'regular':44B,104C,119C,172C,202C,211C,230C 'releas':53B,138C 'remov':179C 'resolv':94C 'return':164C,212C 'server':167C 'set':197C 'smb':3A,23B,34B,95C 'smb-client':22B 'sourc':68B 'state':71B 'stop':60B 'symlink':5A,39B,66B,82B,114C,133C,158C 'symlink-follow':81B 'track':159C 'unless':200C 'use':97C 'vfs':62B,154C,190C,216C 'vulner':91C 'whether':160C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98451","severity":null,"published_at":"2026-10-18T16:16:55+00:00","modified_at":"2026-10-21T13:21:30+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}