CVE-2026-46040

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails<br /> <br /> When fsnotify_add_inode_mark_locked() fails in inotify_new_watch(),<br /> the error path calls inotify_remove_from_idr() but does not call<br /> dec_inotify_watches() to undo the preceding inc_inotify_watches().<br /> This leaks a watch count, and repeated failures can exhaust the<br /> max_user_watches limit with -ENOSPC even when no watches are active.<br /> <br /> Prior to commit 1cce1eea0aff ("inotify: Convert to using per-namespace<br /> limits"), the watch count was incremented after fsnotify_add_mark_locked()<br /> succeeded, so this path was not affected. The conversion moved<br /> inc_inotify_watches() before the mark insertion without adding the<br /> corresponding rollback.<br /> <br /> Add the missing dec_inotify_watches() call in the error path.