CVE-2026-98451

In the Linux kernel, the following vulnerability has been resolved: smb: client: use…

Risk score: 69/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.2%
Published: 18 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A high-severity vulnerability in the Linux kernel allows an attacker to leak dentry references and potentially gain control over the system. An attacker could exploit this vulnerability by performing an O_CREAT open on a symlink or non-regular inode.
Affected: {'products': ['Linux kernel'], 'packages': [], 'versions': []}
Fix: Check the linked advisory for the fix
Exploitation: No known exploitation

Why it is Amber

CVSS 8.8 high
Remotely exploitable without logging in
On your watchlist: linux kernel

References

Original description

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink. Track whether cifs_do_create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish_no_open() so the VFS can continue the lookup. Do not set FMODE_CREATED unless a regular file was opened. For O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's -EFTYPE check. Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails.

Last activity 18 Oct 2026. Patch Forecast updates every hour.