CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask()

Published Jun 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: fix inode reference leak in fsnotifyrecalcmask()

fsnotifyrecalcmask() fails to handle the return value of fsnotifyrecalcmask(), which may return an inode pointer that needs to be released via fsnotifydropobject() when the connector's HASIREF flag transitions from set to cleared.

This manifests as a hung task with the following call trace:

INFO: task umount:1234 blocked for more than 120 seconds. Call Trace: schedule schedule fsnotifysbdelete genericshutdownsuper killanonsuper cleanupmnt taskworkrun doexit dogroupexit

The race window that triggers the iref leak:

Thread A (adding mark) Thread B (removing mark) ────────────────────── ──────────────────────── fsnotifyaddmarklocked(): fsnotifyaddmarklist(): spinlock(conn->lock) add markB(evictable) to list spinunlock(conn->lock) return

/ ---- gap: no lock held ---- /

fsnotifydetachmark(markA): spinlock(markA->lock) clear ATTACHED flag on markA spinunlock(markA->lock) fsnotifyputmark(markA)

fsnotifyrecalcmask(): spinlock(conn->lock) fsnotifyrecalcmask(): / markA skipped: ATTACHED cleared / / only markB(evictable) remains / wantiref = false hasiref = true / not yet cleared / -> HASIREF transitions true -> false -> returns inode pointer spinunlock(conn->lock) / BUG: return value discarded! iput() and fsnotifyputsbwatchedobjects() are never called /

Fix this by deferring the transition true -> false of HASIREF flag from fsnotifyrecalcmask() (Thread A) to fsnotifyputmark() (thread B).

Affected Software

7 affected components
Linux Linux kernel
Linux Linux kernel>=5.10.220<5.11
Linux Linux kernel>=5.15.154<5.16
Linux Linux kernel>=5.19<6.12.91
Linux Linux kernel>=6.13<6.18.33
Linux Linux kernel>=6.19<7.0.10
Linux Linux kernel=7.1-rc1

Event History

Jun 24, 2026
CVE Published
via MITRE·04:29 PM
Data Sourced
via MITRE·04:29 PM
Description
Data Sourced
via NVD·05:17 PM
RemedyDescriptionSeverityAffected Software

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203