CVE-2026-46040 inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
A resource leak in the Linux kernel inotify subsystem allows attackers to exhaust watch limits, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46040?
CVE-2026-46040 is a medium-severity denial of service vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
When fsnotify_add_inode_mark_locked() fails in inotify_new_watch(), the error path calls inotify_remove_from_idr() but does not call dec_inotify_watches() to undo the preceding inc_inotify_watches(). This leaks a watch count, and repeated failures can exhaust the max_user_watches limit with -ENOSPC even when no watches are active.
Prior to commit 1cce1eea0aff ("inotify: Convert to using per-namespace limits"), the watch count was incremented after fsnotify_add_mark_locked() succeeded, so this path was not affected. The conversion moved inc_inotify_watches() before the mark insertion without adding the corresponding rollback.
Add the missing dec_inotify_watches() call in the error path.
Which versions are affected by CVE-2026-46040?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46040?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-46040 being exploited?
There is no known exploitation of CVE-2026-46040 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88467, BELL-CVE-2026-46040, DEBIAN-CVE-2026-46040, GHSA-38g3-xqxq-2v2p, ROOT-OS-DEBIAN-11-CVE-2026-46040, ROOT-OS-DEBIAN-12-CVE-2026-46040 and 3 more.