Linux Kernel EUVD-2026-103691

Requires the Linux in-tree CIFS/SMB client (cifs.ko) to have mounted a share from an attacker-controlled or compromised SMB server, and a process on the client to perform an O_CREAT open that the server resolves to a non-regular inode (e.g. a symlink or other non-regular file). The leak occurs specifically in cifs_atomic_open()/cifs_do_create() when an existing non-regular inode is found on such an open, with a legacy POSIX handle path also involved. Limiting factors: the attacker must control the SMB server the victim mounts and the victim must actively open a crafted path (UI:R); the bug only affects systems using the CIFS client (not a default-enabled network service), and establishing the mount itself typically requires administrative privilege.

Signals conflict sharply. The supplied CVSS is 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), which implies high confidentiality, integrity and availability impact, but the description only documents a dentry reference leak in cifs_atomic_open() plus an FMODE_OPENED flag that prevents the VFS from following a symlink - i.e. a resource leak and a lookup/correctness defect, not memory corruption or code execution. The CVSS C:H/I:H/A:H rating is therefore not corroborated by the described mechanism; treat the 8.8 as a conservative auto-assignment and verify impact with the kernel maintainers. EPSS is 0.17% (6th percentile), consistent with this being a low real-world exploitation-probability issue. It is NOT in CISA KEV, and no public exploit is identified. The vuln.today decision label is this_week, reflecting a patch-this-cycle hygiene item rather than an emergency. Exploitation also depends on the victim mounting and using an attacker-controlled SMB share, which is not reflected in the PR:N/AV:N framing. Net: a genuine kernel correctness/leak bug worth patching on the normal stable cadence, but the headline 8.8 overstates the practical risk given low EPSS, no KEV, no PoC, and a client-side, malicious-server-dependent trigger.

A Linux host mounts a CIFS/SMB share from an attacker-controlled or compromised server; when a process performs an O_CREAT open that the server resolves to a non-regular inode such as a symlink, cifs_atomic_open() calls finish_open() and attaches a cifsFileInfo whose dentry reference is never released, while FMODE_OPENED blocks correct symlink handling. Repeatedly triggering this leaks kernel dentry references over time and disrupts expected symlink resolution on the mount. No public exploit code is identified at time of analysis.