CVE-2026-52990: Linux Kernel fsnotify Reference Leak Causes System Hangs

Technical summary

CVE-2026-52990 is a reference leak in fsnotify_recalc_mask() within the Linux kernel's file notification subsystem. The vulnerability occurs when __fsnotify_recalc_mask() detects a transition of the HAS_IREF flag from set to cleared but the calling function discards the returned inode pointer without invoking the required fsnotify_drop_object() cleanup. The race window exists between the time a mark is added (unlocked) and mask recalculation is performed. Thread B removes a mark while Thread A adds another concurrently; the connector's reference state changes, but Thread A's subsequent recalc_mask call returns a pointer that is never released, accumulating unreleased references. The fix defers the HAS_IREF transition from fsnotify_recalc_mask() to fsnotify_put_mark(), eliminating the gap where the return value can be lost.

Business impact

This vulnerability impacts availability on systems relying on fsnotify-based monitoring (audit, SELinux, fanotify users, and other inode watch mechanisms). Hung task conditions disrupt critical operations like unmounting file systems, potentially stalling deployments, container orchestration, and storage maintenance. Systems experiencing concurrent file system monitoring changes under load are at highest risk. The hung task can propagate through system shutdown sequences, complicating recovery.

Affected systems

All Linux kernel versions containing the fsnotify subsystem are affected. The vulnerability manifests when file notification monitoring marks are actively added and removed concurrently on the same inode or connector. Systems running container workloads, audit daemons, SELinux, or applications using fanotify are most likely to encounter the race condition. Verify the specific kernel version in your environment against the vendor's fixed versions.

Exploitability

This is not a remote or local privilege escalation vulnerability. Exploitability requires local unprivileged user context and relies on inducing specific concurrent mark operations, making it a reliability/availability defect rather than a security boundary bypass. However, local users can inadvertently trigger the condition through normal fsnotify operations (e.g., simultaneous audit rule changes or concurrent inode watch setup), causing denial of service without requiring root privilege or special tools.

Remediation

Apply a kernel update that includes the fsnotify reference leak fix. Verify against the vendor advisory for the corrected kernel version. The fix involves deferring the HAS_IREF flag transition from fsnotify_recalc_mask() to fsnotify_put_mark() to ensure the inode reference is properly released. Until patched, avoid rapid concurrent addition and removal of file notification marks on the same inode; batch or serialize monitoring setup operations if possible.

Patch guidance

Obtain and deploy the patched Linux kernel version from your distribution or vendor. The fix is upstream in the mainline kernel; check your Linux vendor's security advisory for the corresponding stable backport version. Standard kernel update procedures (apt, yum, zypper with reboot) apply. Verify the patch is included by checking kernel changelog or release notes before deployment.

Detection guidance

Monitor system logs for hung task warnings mentioning fsnotify_sb_delete or umount in the call stack. Check for processes blocked in __schedule() during fsnotify-related operations. Systems under high fsnotify load (many concurrent audit rules, SELinux policy changes, or fanotify watches) combined with file system unmount attempts are prime indicators. Kernel WARN logs detailing hung tasks lasting over 120 seconds are the canonical symptom.

Why prioritize this

Prioritize this patch for systems running production workloads with active file system monitoring (audit, SELinux, container environments). The CVSS score of 5.5 (Medium) reflects local availability impact without confidentiality or integrity loss. However, hung umount operations can cascade into broader system outages, particularly in orchestrated environments. The fix is straightforward and low-risk, making deployment scheduling straightforward.

Risk score, explained

CVSS 3.1 score 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects local-only attack surface, low attack complexity (race window is narrow but reliably triggerable under load), low privilege requirement, and high availability impact. No confidentiality or integrity loss. The score appropriately captures a reliability defect with local DoS potential that does not elevate privileges or expose data.

Frequently asked questions