fsnotify: prevent mark additions during connector teardown

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99175
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-28 11:17:38 UTC
Updated2026-10-30 13:21:51 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotify_destroy_marks() keeps a reference to its current mark while it drops conn->lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a new mark from being inserted before it. For example, an inotify watch re-added after IN_IGNORED sorts before the old, detached mark for the same group. The walk can miss the replacement and then detach the entire connector from the object. The replacement is still on its group's marks_list and, for inotify, in the watch IDR. The group mutex no longer protects the connector's object from disappearing. An unprivileged fdinfo read racing the final detach can consequently call igrab(NULL): BUG: KASAN: null-ptr-deref in igrab+0x24/0x100 Write of size 4 at addr 0000000000000148 Call Trace: igrab+0x24/0x100 inotify_show_fdinfo+0x1dc/0x5e0 seq_show+0x397/0x690 Set a DESTROYING flag under conn->lock before starting the walk, and reject new marks on that connector with -ENOENT. The existing add-mark error paths undo the temporary group-list entry and the backend's watch allocation. Do not wait for teardown while holding the group mutex, which the destroyer needs. Once the old connector is detached, an add can install a fresh connector as before. This closes the insertion race for all object types using the common connector teardown, without changing the mark reference or SRCU lifetime rules.

Risk And Classification

EPSS: 0.001770000 probability, percentile 0.072830000 (date 2026-11-01)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 6b3f05d24d355f50f3d9814304650fcab0efb482 f7def717c06aea7004905e4d1568c3691ef9825d git Not specified
CNA Linux Linux affected 6b3f05d24d355f50f3d9814304650fcab0efb482 da2f9aa89ef1b1fe7a7c6e1a8ddacd9c975e86aa git Not specified
CNA Linux Linux affected 6b3f05d24d355f50f3d9814304650fcab0efb482 587d80966dcce2824f13fd32dab83bf882acf66f git Not specified
CNA Linux Linux affected 6b3f05d24d355f50f3d9814304650fcab0efb482 d28a460a2237220d9ccbdd3baac6eaead44e96cb git Not specified
CNA Linux Linux affected 6b3f05d24d355f50f3d9814304650fcab0efb482 61133f15773b907bada651a02d9c6d38eae37c48 git Not specified
CNA Linux Linux affected 6b3f05d24d355f50f3d9814304650fcab0efb482 952501bfc6e5e654ac4a17ec9d90c1ec614bd9f1 git Not specified
CNA Linux Linux affected 6b3f05d24d355f50f3d9814304650fcab0efb482 472589eacdf10b5f9bd10b333957ed5291b2544b git Not specified
CNA Linux Linux affected 6b3f05d24d355f50f3d9814304650fcab0efb482 36ebddca56b9d8993d6dc984fdecc748ee1f5e06 git Not specified
CNA Linux Linux affected 4.12 Not specified
CNA Linux Linux unaffected 4.12 semver Not specified
CNA Linux Linux unaffected 5.10.273 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.224 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.191 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.161 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.115 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.59 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.13 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/952501bfc6e5e654ac4a17ec9d90c1ec614bd9f1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/587d80966dcce2824f13fd32dab83bf882acf66f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f7def717c06aea7004905e4d1568c3691ef9825d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/61133f15773b907bada651a02d9c6d38eae37c48 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/36ebddca56b9d8993d6dc984fdecc748ee1f5e06 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/da2f9aa89ef1b1fe7a7c6e1a8ddacd9c975e86aa 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d28a460a2237220d9ccbdd3baac6eaead44e96cb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/472589eacdf10b5f9bd10b333957ed5291b2544b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report