CVE-2026-98452: smb: client: clean up failed cached directory opens

In the Linux kernel, the following vulnerability has been resolved:

smb: client: clean up failed cached directory opens

opencacheddir() sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common cleanup can issue SMB2close(). It also must not treat a response error as a valid CREATE.

Validate the CREATE response before using its fields, record the FIDs, and mark the handle open before handling errors from later compound commands. Move the -EREMCHG reconnect handling before response validation so a missing response does not hide the reconnect request. Count the handle when it is marked open; confirmed close responses decrement the counter, while existing close retry behavior remains best effort on transport failures.