UBUNTU-CVE-2026-98451: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen() for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen() calls finishopen() on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release operation, so the dentry reference held by cifsFileInfo is leaked. FMODEOPENED also prevents the VFS from following the symlink. Track whether cifsdocreate() returned an open server handle. For non-regular inodes, close the handle if present, remove the pending open, and call finishnoopen() so the VFS can continue the lookup. Do not set FMODECREATED unless a regular file was opened. For ONOFOLLOW with OREGULAR, return -ELOOP before the VFS's -EFTYPE check. Defer closing a legacy POSIX handle on a non-regular inode until after inode lookup. This avoids closing it again if lookup fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update the Linux kernel SMB client open path to defer closing a legacy POSIX handle until after inode lookup; track whether cifs_do_create() returned an open server handle; set FMODE_CREATED only for regular files; use FMODE_OPENED to prevent VFS symlink following; return -ELOOP for O_NOFOLLOW with __O_REGULAR before the VFS -EFTYPE check; and for non-regular inodes, close any present handle, remove the pending open, and call finish_no_open() so the VFS can continue lookup. cifs_atomic_open() should call finish_open() on the returned handle and attach a cifsFileInfo.