CVE-2026-98451

In the Linux kernel, the following vulnerability has been resolved:

smb: client: use finish_no_open() for non-regular inodes

An O_CREAT open can find an existing symlink or another non-regular

inode. cifs_atomic_open() calls finish_open() on it and attaches a

cifsFileInfo. Symlink inodes have no CIFS release operation, so the

dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also

prevents the VFS from following the symlink.

Track whether cifs_do_create() returned an open server handle. For

non-regular inodes, close the handle if present, remove the pending

open, and call finish_no_open() so the VFS can continue the lookup.

Do not set FMODE_CREATED unless a regular file was opened. For

O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's

-EFTYPE check.

Defer closing a legacy POSIX handle on a non-regular inode until

after inode lookup. This avoids closing it again if lookup fails.