Executive brief
A vulnerability in the Linux kernel's file monitoring system (inotify) can allow a local user to exhaust system resources. By triggering specific error conditions when setting up file watches, the system fails to properly reset its internal counters. Over time, this can prevent any user or application on the system from monitoring file changes, potentially disrupting security software or system services that rely on these notifications.
Technical details
A resource leak exists in the inotify subsystem of the Linux kernel within the inotify_new_watch() function. When fsnotify_add_inode_mark_locked() fails, the error handling path fails to call dec_inotify_watches() to roll back the increment performed by inc_inotify_watches(). This results in a leak of the per-namespace watch count. A local attacker can repeatedly trigger this failure path to exhaust the max_user_watches limit, resulting in -ENOSPC errors for legitimate inotify requests even when no active watches exist. The issue was introduced during the conversion to per-namespace limits and has been fixed by adding the missing decrement call in the error path.
Affected products
- Linux Linux Kernel Introduced in 1cce1eea0aff; fixed in 6.1, 6.6, 6.12, 6.13, and 7.0+
Timeline
- 2026-02-24: other: Patch authored
- 2026-05-27: advisory: CVE published
References
- https://git.kernel.org/stable/c/6a320935fa4293e9e599ec9f85dc9eb3be7029f8
- https://git.kernel.org/stable/c/73ddc8518a32baff6bc17afda4ee1ebae5b4ed12
- https://git.kernel.org/stable/c/8bcc1cd237ab5ccfdd102869fa031c541943cf40
- https://git.kernel.org/stable/c/9e48844f708eb48bae4e79cb21edc097c966306d
- https://git.kernel.org/stable/c/fdaa42ca370d056428e5e171247c8fdce8dff36a