CVE-2026-52990

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fsnotify: fix inode reference leak in fsnotify_recalc_mask()<br /> <br /> fsnotify_recalc_mask() fails to handle the return value of<br /> __fsnotify_recalc_mask(), which may return an inode pointer that needs<br /> to be released via fsnotify_drop_object() when the connector&amp;#39;s HAS_IREF<br /> flag transitions from set to cleared.<br /> <br /> This manifests as a hung task with the following call trace:<br /> <br /> INFO: task umount:1234 blocked for more than 120 seconds.<br /> Call Trace:<br /> __schedule<br /> schedule<br /> fsnotify_sb_delete<br /> generic_shutdown_super<br /> kill_anon_super<br /> cleanup_mnt<br /> task_work_run<br /> do_exit<br /> do_group_exit<br /> <br /> The race window that triggers the iref leak:<br /> <br /> Thread A (adding mark) Thread B (removing mark)<br /> ────────────────────── ────────────────────────<br /> fsnotify_add_mark_locked():<br /> fsnotify_add_mark_list():<br /> spin_lock(conn-&gt;lock)<br /> add mark_B(evictable) to list<br /> spin_unlock(conn-&gt;lock)<br /> return<br /> <br /> /* ---- gap: no lock held ---- */<br /> <br /> fsnotify_detach_mark(mark_A):<br /> spin_lock(mark_A-&gt;lock)<br /> clear ATTACHED flag on mark_A<br /> spin_unlock(mark_A-&gt;lock)<br /> fsnotify_put_mark(mark_A)<br /> <br /> fsnotify_recalc_mask():<br /> spin_lock(conn-&gt;lock)<br /> __fsnotify_recalc_mask():<br /> /* mark_A skipped: ATTACHED cleared */<br /> /* only mark_B(evictable) remains */<br /> want_iref = false<br /> has_iref = true /* not yet cleared */<br /> -&gt; HAS_IREF transitions true -&gt; false<br /> -&gt; returns inode pointer<br /> spin_unlock(conn-&gt;lock)<br /> /* BUG: return value discarded!<br /> * iput() and fsnotify_put_sb_watched_objects()<br /> * are never called */<br /> <br /> Fix this by deferring the transition true -&gt; false of HAS_IREF flag from<br /> fsnotify_recalc_mask() (Thread A) to fsnotify_put_mark() (thread B).