CVE-2026-98451: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-98451 Overview

CVE-2026-98451 is a Linux kernel vulnerability in the SMB client (cifs) code that mishandles O_CREAT opens when the target path resolves to a non-regular inode such as a symbolic link. The function cifs_atomic_open() calls finish_open() on the existing inode and attaches a cifsFileInfo structure. Because symlink inodes have no CIFS release operation, the dentry reference held by cifsFileInfo is leaked. Setting FMODE_OPENED also prevents the Virtual File System (VFS) layer from following the symlink correctly. The fix routes non-regular inodes through finish_no_open() so the VFS can continue the lookup.

Critical Impact
Repeated O_CREAT opens against SMB-mounted symlinks leak dentry references, causing kernel resource exhaustion and preventing correct symlink traversal.

Affected Products

Linux kernel SMB/CIFS client (fs/smb/client)
Multiple stable kernel branches referenced in the upstream fix commits
Systems mounting remote SMB/CIFS shares that contain symlinks or other non-regular inodes

Discovery Timeline

2026-10-18 - CVE-2026-98451 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98451

Vulnerability Analysis

The defect lives in the atomic open path of the Linux kernel's SMB client. When userspace issues open(path, O_CREAT, ...) and the server-side object already exists as a symlink or other non-regular inode, cifs_atomic_open() incorrectly treats it like a regular file. It invokes finish_open() and attaches a cifsFileInfo structure to the open file. Symlink inodes do not register a CIFS release handler, so the dentry reference embedded in cifsFileInfo is never dropped. The leak accumulates per failed open and degrades kernel memory and dentry cache accounting over time. In addition, finish_open() sets FMODE_OPENED, which signals the VFS that the open completed and blocks the standard symlink-following logic.

Root Cause

The root cause is a missing distinction between regular and non-regular inodes in cifs_atomic_open(). The code does not track whether cifs_do_create() returned an active server handle, so cleanup paths cannot close that handle or remove the pending open entry when the inode turns out to be a symlink. FMODE_CREATED is also set unconditionally rather than only when a regular file was actually created.

Attack Vector

A local user with access to an SMB-mounted share can trigger the leak by repeatedly calling open() with O_CREAT on paths that resolve to a symlink on the server. The condition is reachable without special privileges whenever the mount is accessible to the user. The __O_REGULAR plus O_NOFOLLOW combination exposes a second variant where the code must return -ELOOP before the VFS performs its -EFTYPE check. No remote network attacker interaction with the kernel is required beyond serving crafted directory contents from the SMB server.

No verified public proof-of-concept code is available. See the upstream patches for the exact logic change: Kernel Git Commit 045532f, Kernel Git Commit 3c07deb, Kernel Git Commit 70a7918, Kernel Git Commit e66cf16, and Kernel Git Commit ed03d54.

Detection Methods for CVE-2026-98451

Indicators of Compromise

Steadily rising dentry and cifs_file_info slab counts in /proc/slabinfo on hosts with active SMB mounts.
Processes repeatedly issuing openat(..., O_CREAT, ...) against paths on SMB mounts that resolve to symlinks.
Unexpected -EFTYPE or missing -ELOOP returns from open() calls using O_NOFOLLOW on CIFS paths.

Detection Strategies

Audit syscall telemetry for openat calls with O_CREAT targeting CIFS/SMB mount points and correlate with inode type.
Track kernel memory pressure on SMB client hosts over time; a slow, monotonic growth in dentry cache usage without workload change is suspicious.
Monitor kernel version inventories to flag hosts running branches that predate the fix commits listed in the references.

Monitoring Recommendations

Enable Linux audit rules on open, openat, and openat2 for file systems of type cifs or smb3.
Collect /proc/meminfo, /proc/slabinfo, and /sys/kernel/debug/cifs/Stats metrics into a central log pipeline.
Alert on sustained growth of cifs_file_info allocations without a matching release rate.

How to Mitigate CVE-2026-98451

Immediate Actions Required

Inventory all Linux hosts that mount SMB/CIFS shares and identify kernels that lack the referenced fix commits.
Schedule kernel updates to a stable release containing the finish_no_open() fix for non-regular inodes.
Restrict write and symlink creation privileges on SMB shares to trusted principals until patching is complete.

Patch Information

The fix tracks whether cifs_do_create() returned an open server handle, closes it for non-regular inodes, removes the pending open, and calls finish_no_open() so the VFS continues the lookup. It also avoids setting FMODE_CREATED unless a regular file was opened and returns -ELOOP early for O_NOFOLLOW with __O_REGULAR. The upstream commits are 045532f, 3c07deb, 70a7918, e66cf16, and ed03d54. Apply the vendor-provided kernel package that includes the backport for your distribution.

Workarounds

Unmount SMB/CIFS shares on affected hosts where feasible until a patched kernel is deployed.
Prevent creation of symlinks on SMB shares by adjusting server-side permissions and share options.
Avoid application patterns that call open() with O_CREAT against paths that may resolve to symlinks on SMB mounts.

bash

# Identify kernel version and active CIFS mounts on a host
uname -r
mount -t cifs,smb3
grep -E 'cifs_file_info|dentry' /proc/slabinfo