CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask()

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: fix inode reference leak in fsnotifyrecalcmask()

fsnotifyrecalcmask() fails to handle the return value of fsnotifyrecalcmask(), which may return an inode pointer that needs to be released via fsnotifydropobject() when the connector's HASIREF flag transitions from set to cleared.

This manifests as a hung task with the following call trace:

INFO: task umount:1234 blocked for more than 120 seconds. Call Trace: schedule schedule fsnotifysbdelete genericshutdownsuper killanonsuper cleanupmnt taskworkrun doexit dogroupexit

The race window that triggers the iref leak:

Thread A (adding mark) Thread B (removing mark) ────────────────────── ──────────────────────── fsnotifyaddmarklocked(): fsnotifyaddmarklist(): spinlock(conn->lock) add markB(evictable) to list spinunlock(conn->lock) return

/ ---- gap: no lock held ---- /

fsnotifydetachmark(markA): spinlock(markA->lock) clear ATTACHED flag on markA spinunlock(markA->lock) fsnotifyputmark(markA)

fsnotifyrecalcmask(): spinlock(conn->lock) fsnotifyrecalcmask(): / markA skipped: ATTACHED cleared / / only markB(evictable) remains / wantiref = false hasiref = true / not yet cleared / -> HASIREF transitions true -> false -> returns inode pointer spinunlock(conn->lock) / BUG: return value discarded! iput() and fsnotifyputsbwatchedobjects() are never called /

Fix this by deferring the transition true -> false of HASIREF flag from fsnotifyrecalcmask() (Thread A) to fsnotifyputmark() (thread B).