CVE-2026-98451

In the Linux kernel, the following vulnerability has been resolved:

smb: client: use finish no open() for non-regular inodes

An O CREAT open can find an existing symlink or another non-regular inode. cifs atomic open() calls finish open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE OPENED also prevents the VFS from following the symlink.

Track whether cifs do create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish no open() so the VFS can continue the lookup. Do not set FMODE CREATED unless a regular file was opened. For O NOFOLLOW with O REGULAR, return -ELOOP before the VFS's -EFTYPE check.

Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails.