CVE-2026-98451 smb: client: use finish_no_open() for non-regular inodes
A local attacker can cause a memory leak and potential denial of service in the Linux kernel SMB client by opening non-regular inodes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98451?
CVE-2026-98451 is a high-severity memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: use finish_no_open() for non-regular inodes
An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink.
Track whether cifs_do_create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish_no_open() so the VFS can continue the lookup. Do not set FMODE_CREATED unless a regular file was opened. For O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's -EFTYPE check.
Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails.
Which versions are affected by CVE-2026-98451?
How do I fix CVE-2026-98451?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98451 being exploited?
There is no known exploitation of CVE-2026-98451 in the wild and no public exploit code.
Sources
Also known as AZL-108800, BELL-CVE-2026-98451, DEBIAN-CVE-2026-98451, GHSA-8vx8-gc8p-9x99, UBUNTU-CVE-2026-98451.