inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails When fsnotify_add_inode_mark_locked() fails in inotify_new_watch(), the error path calls inotify_remove_from_idr() but does not call dec_inotify_watches() to undo the preceding inc_inotify_watches(). This leaks a watch count, and repeated failures can exhaust the max_user_watches limit with -ENOSPC even when no watches are active. Prior to commit 1cce1eea0aff ("inotify: Convert to using per-namespace limits"), the watch count was incremented after fsnotify_add_mark_locked() succeeded, so this path was not affected. The conversion moved inc_inotify_watches() before the mark insertion without adding the corresponding rollback. Add the missing dec_inotify_watches() call in the error path.
CVE-2026-46040
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-46040
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"lessThan": "3ab58cf42c46bf2366d2f55ae5c59299d5e178b7",
"versionType": "git"
},
{
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"lessThan": "10edf7e0ffdc7faa18e2244b17722c1b882b8273",
"versionType": "git"
},
{
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"lessThan": "3ad9ccea1b25435f6179b57aa891960beb7ce8f9",
"versionType": "git"
},
{
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"lessThan": "8bcc1cd237ab5ccfdd102869fa031c541943cf40",
"versionType": "git"
},
{
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"lessThan": "73ddc8518a32baff6bc17afda4ee1ebae5b4ed12",
"versionType": "git"
},
{
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"lessThan": "fdaa42ca370d056428e5e171247c8fdce8dff36a",
"versionType": "git"
},
{
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"lessThan": "9e48844f708eb48bae4e79cb21edc097c966306d",
"versionType": "git"
},
{
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"lessThan": "6a320935fa4293e9e599ec9f85dc9eb3be7029f8",
"versionType": "git"
}
],
"programFiles": [
"fs/notify/inotify/inotify_user.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.11",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/notify/inotify/inotify_user.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-46040
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #28378 · Revision 1
- Added to Heist Feed
- Publisher date