Executive brief
A vulnerability in the Linux kernel's file system notification system (fsnotify) can cause system tasks to hang indefinitely. This occurs due to a technical error where the system fails to properly release internal file references during specific file monitoring operations. In practice, this can lead to a denial-of-service where users are unable to unmount drives or shut down the system normally, potentially disrupting operations and requiring a hard reboot.
Technical details
An inode reference leak exists in fsnotify_recalc_mask() due to a failure to handle the return value of __fsnotify_recalc_mask(). When a connector's HAS_IREF flag transitions from set to cleared during a race between adding an evictable mark and detaching a non-evictable mark, the returned inode pointer is discarded instead of being released via fsnotify_drop_object(). This results in a leaked reference that prevents the associated superblock from being cleaned up, manifesting as tasks (such as 'umount') blocking indefinitely in fsnotify_sb_delete(). The fix involves deferring the HAS_IREF transition to ensure references are properly dropped.
Affected products
- Linux Linux Kernel 5.10.220 to 5.11, 6.1, 6.6, 6.8
Timeline
- 2026-04-20: patched: Initial fix committed to mainline kernel
- 2026-06-24: disclosed: CVE-2026-52990 published