PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46040 Linux CVE debrief

A resource leak vulnerability in the Linux kernel's inotify subsystem allows watch count exhaustion through repeated failed watch creation attempts. The flaw exists in inotify_new_watch() where fsnotify_add_inode_mark_locked() failure triggers an error path that removes the watch from the IDR but fails to decrement the per-user watch counter. This regression was introduced when commit 1cce1eea0aff moved inc_inotify_watches() before mark insertion without adding corresponding rollback logic. Successful exploitation results in premature -ENOSPC errors that block legitimate inotify usage even when no active watches exist. The vulnerability is local-only and requires ability to trigger inotify watch creation failures. Multiple stable kernel branches have received patches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux system administrators, kernel maintainers, and security teams monitoring for local denial-of-service conditions affecting file system monitoring infrastructure

Technical summary

The inotify_new_watch() function in fs/notify/inotify/inotify_user.c increments the per-user watch count via inc_inotify_watches() before attempting to insert the mark with fsnotify_add_inode_mark_locked(). When this insertion fails, the error path calls inotify_remove_from_idr() to clean up the IDR entry but omits dec_inotify_watches(), leaving the counter elevated. Repeated failures allow unprivileged users to exhaust max_user_watches, causing subsequent legitimate inotify operations to fail with -ENOSPC. The vulnerability is a regression from the per-namespace limits conversion in commit 1cce1eea0aff.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor for -ENOSPC errors from inotify_add_watch() that occur despite low active watch counts
  • Audit applications using inotify for error handling that may trigger repeated failed watch creation attempts
  • Consider temporary increase of fs.inotify.max_user_watches sysctl if operational impact occurs before patching
  • Review kernel changelogs for backport status to your specific kernel version

Evidence notes

Vulnerability description confirms the bug was introduced during conversion to per-namespace limits in commit 1cce1eea0aff. The fix adds dec_inotify_watches() to the error path in inotify_new_watch(). Five stable kernel commits provided indicate backports to multiple supported branches. No CVSS score assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46040 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46040

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46040 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46040

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6a320935fa4293e9e599ec9f85dc9eb3be7029f8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/73ddc8518a32baff6bc17afda4ee1ebae5b4ed12

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8bcc1cd237ab5ccfdd102869fa031c541943cf40

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9e48844f708eb48bae4e79cb21edc097c966306d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fdaa42ca370d056428e5e171247c8fdce8dff36a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.