CVE-2026-46040
published 2026-05-27CVE-2026-46040: In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails When…
medium5.5
In the Linux kernel, the following vulnerability has been resolved:
inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
When fsnotify_add_inode_mark_locked() fails in inotify_new_watch(),
the error path calls inotify_remove_from_idr() but does not call
dec_inotify_watches() to undo the preceding inc_inotify_watches().
This leaks a watch count, and repeated failures can exhaust the
max_user_watches limit with -ENOSPC even when no watches are active.
Prior to commit 1cce1eea0aff ("inotify: Convert to using per-namespace
limits"), the watch count was incremented after fsnotify_add_mark_locked()
succeeded, so this path was not affected. The conversion moved
inc_inotify_watches() before the mark insertion without adding the
corresponding rollback.
Add the missing dec_inotify_watches() call in the error path.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 1cce1eea0aff51201753fcaca421df825b0813b6 < 3ab58cf42c46bf2366d2f55ae5c59299d5e178b7 | 3ab58cf42c46bf2366d2f55ae5c59299d5e178b7 |
| linux | linux | >= 1cce1eea0aff51201753fcaca421df825b0813b6 < 10edf7e0ffdc7faa18e2244b17722c1b882b8273 | 10edf7e0ffdc7faa18e2244b17722c1b882b8273 |
| linux | linux | >= 1cce1eea0aff51201753fcaca421df825b0813b6 < 3ad9ccea1b25435f6179b57aa891960beb7ce8f9 | 3ad9ccea1b25435f6179b57aa891960beb7ce8f9 |
| linux | linux | >= 1cce1eea0aff51201753fcaca421df825b0813b6 < 8bcc1cd237ab5ccfdd102869fa031c541943cf40 | 8bcc1cd237ab5ccfdd102869fa031c541943cf40 |
| linux | linux | >= 1cce1eea0aff51201753fcaca421df825b0813b6 < 73ddc8518a32baff6bc17afda4ee1ebae5b4ed12 | 73ddc8518a32baff6bc17afda4ee1ebae5b4ed12 |
| linux | linux | >= 1cce1eea0aff51201753fcaca421df825b0813b6 < fdaa42ca370d056428e5e171247c8fdce8dff36a | fdaa42ca370d056428e5e171247c8fdce8dff36a |
| linux | linux | >= 1cce1eea0aff51201753fcaca421df825b0813b6 < 9e48844f708eb48bae4e79cb21edc097c966306d | 9e48844f708eb48bae4e79cb21edc097c966306d |
| linux | linux | >= 1cce1eea0aff51201753fcaca421df825b0813b6 < 6a320935fa4293e9e599ec9f85dc9eb3be7029f8 | 6a320935fa4293e9e599ec9f85dc9eb3be7029f8 |
| linux | linux_kernel | — | — |