Linux kernel SMB client: Reference leak when opening symlinks on SMB shares
Summary
The Linux kernel SMB/CIFS client does not handle O_CREAT opens that resolve to an existing symlink or other non-regular inode correctly. The dentry reference held by the file handle is never released, and the symlink is not followed by the VFS. An attacker who can influence the contents of a mounted SMB share could trigger repeated reference leaks, which may lead to resource exhaustion or denial of service; confidentiality and integrity impact is not indicated. Exploitation requires a Linux host that mounts the affected share and opens files on it.
Affected
- Linux kernel versions with the SMB client code introduced in d2c127197dfc0b2bae62a52e1e0d3e3ff493919e (version 3.6 onward), until the stable fixes listed in the CVE record.
- Ranges given by the CNA and OSV differ; the exact per-branch affected ranges are unknown.
- Only systems using the kernel SMB client (mount -t cifs) are relevant.
Fixed in
- Stable kernel fixes are referenced in the CVE record (for example commits ed03d547598c92a036f20e89156540995cac889a and e66cf1625ec4a3fe68346119f371def713fd0a4d).
- The CNA lists fixed versions 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.113, 6.18.56 and 7.2.9 (OSV and CNA data).
- Unknown: the exact fixed version for each branch could not be confirmed against kernel.org; sources conflict.
Workaround
- No vendor-published workaround is known.
- Limit SMB mounts on affected hosts to trusted servers.
- Stop mounting untrusted or third-party SMB shares until the kernel is patched.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- KEV status: not confirmed against the CISA catalogue.
Our recommendation
- Inventory Linux hosts that mount SMB shares (mount -t cifs).
- Apply the kernel update from your distribution as soon as it is available.
- Restrict SMB mounts to trusted servers until patched.
- Monitor kernel and distribution advisories for the final fixed versions.
- Severity: CVSS 3.1 8.8 from the CVE data; the authoritative NVD score is unknown and vendor scores differ.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 045532f920d86dd76600b635f9756e5fd671ddfc git.kernel.org
- Linux stable commit e66cf1625ec4a3fe68346119f371def713fd0a4d git.kernel.org
- Linux stable commit ed03d547598c92a036f20e89156540995cac889a git.kernel.org
- Ubuntu security notice CVE-2026-98451 ubuntu.com
- SUSE CVE entry via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:54.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finish_no_open() for non-regular inodes An O_CREAT open can find an existing symlink or another non-regular inode. cifs_atomic_open() calls finish_open() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODE_OPENED also prevents the VFS from following the symlink. Track whether cifs_do_create() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finish_no_open() so the VFS can continue the lookup. Do not set FMODE_CREATED unless a regular file was opened. For O_NOFOLLOW with __O_REGULAR, return -ELOOP before the VFS's -EFTYPE check. Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails.
NVD references (8)
- https://git.kernel.org/stable/c/045532f920d86dd76600b635f9756e5fd671ddfc
- https://git.kernel.org/stable/c/26f4bca335e719e291995e28dc434de0145a6a54
- https://git.kernel.org/stable/c/3c07deb26273155c180aedfd9041ab58015d2521
- https://git.kernel.org/stable/c/51c7b0593f6eaba05349fd2a01a9cb4df7d7412f
- https://git.kernel.org/stable/c/70a7918fda54a06d836acc91eb9a3c7e860fe0a0
- https://git.kernel.org/stable/c/bc585d5a381ab49cb611c35dda93a997214ca874
- https://git.kernel.org/stable/c/e66cf1625ec4a3fe68346119f371def713fd0a4d
- https://git.kernel.org/stable/c/ed03d547598c92a036f20e89156540995cac889a
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.