CVE-2026-99175

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fsnotify: prevent mark additions during connector teardown<br /> <br /> fsnotify_destroy_marks() keeps a reference to its current mark while it<br /> drops conn-&gt;lock to destroy the mark. This stabilizes the forward-walk<br /> cursor, but does not prevent a new mark from being inserted before it.<br /> For example, an inotify watch re-added after IN_IGNORED sorts before the<br /> old, detached mark for the same group. The walk can miss the replacement<br /> and then detach the entire connector from the object.<br /> <br /> The replacement is still on its group&amp;#39;s marks_list and, for inotify, in<br /> the watch IDR. The group mutex no longer protects the connector&amp;#39;s object<br /> from disappearing. An unprivileged fdinfo read racing the final detach<br /> can consequently call igrab(NULL):<br /> <br /> BUG: KASAN: null-ptr-deref in igrab+0x24/0x100<br /> Write of size 4 at addr 0000000000000148<br /> Call Trace:<br /> igrab+0x24/0x100<br /> inotify_show_fdinfo+0x1dc/0x5e0<br /> seq_show+0x397/0x690<br /> <br /> Set a DESTROYING flag under conn-&gt;lock before starting the walk, and<br /> reject new marks on that connector with -ENOENT. The existing add-mark<br /> error paths undo the temporary group-list entry and the backend&amp;#39;s watch<br /> allocation. Do not wait for teardown while holding the group mutex,<br /> which the destroyer needs. Once the old connector is detached, an add<br /> can install a fresh connector as before.<br /> <br /> This closes the insertion race for all object types using the common<br /> connector teardown, without changing the mark reference or SRCU lifetime<br /> rules.