CVE-2026-46040: Linux Kernel inotify DoS Vulnerability

CVE-2026-46040 Overview

CVE-2026-46040 is a resource leak vulnerability in the Linux kernel's inotify subsystem. The flaw resides in the inotify_new_watch() function within the file notification code. When fsnotify_add_inode_mark_locked() fails, the error path calls inotify_remove_from_idr() but omits the matching dec_inotify_watches() call needed to undo the earlier inc_inotify_watches(). Each failed watch creation leaks a watch count against the per-namespace max_user_watches limit. Repeated failures eventually exhaust the limit and cause subsequent inotify_add_watch() calls to return -ENOSPC, even when no watches are active. The regression was introduced by commit 1cce1eea0aff ("inotify: Convert to using per-namespace limits").

Critical Impact
Local users can trigger repeated inotify watch creation failures to exhaust the per-namespace watch limit, denying file change notification services to legitimate workloads.

Affected Products

Linux kernel versions containing commit 1cce1eea0aff ("inotify: Convert to using per-namespace limits")
Linux kernel stable branches prior to the fix commits referenced below
Distributions shipping kernels with per-namespace inotify limits enabled

Discovery Timeline

2026-05-27 - CVE-2026-46040 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46040

Vulnerability Analysis

The vulnerability is a kernel resource accounting leak in the inotify file system notification interface. inotify_new_watch() increments the user's watch count via inc_inotify_watches() before attempting to insert the mark with fsnotify_add_inode_mark_locked(). When the insertion fails, the function reaches an error path that removes the mark from the IDR using inotify_remove_from_idr() but never rolls back the prior increment. The accounted watch count diverges from the actual number of installed watches.

Root Cause

The regression originated in commit 1cce1eea0aff, which converted inotify to per-namespace watch accounting. Before the conversion, the watch count was incremented only after fsnotify_add_mark_locked() succeeded, so a failure required no rollback. The conversion moved inc_inotify_watches() ahead of the mark insertion without introducing a paired dec_inotify_watches() in the failure path. The fix adds the missing decrement so accounting remains balanced when mark insertion fails.

Attack Vector

A local unprivileged user can repeatedly invoke inotify_add_watch() under conditions that force fsnotify_add_inode_mark_locked() to fail. Each failed call leaks one watch slot against the per-namespace max_user_watches limit. After enough failures, every subsequent watch request returns -ENOSPC even when no watches exist for that user. Applications that rely on inotify for file synchronization, build tooling, container orchestration, or security monitoring lose notification capability until the namespace state is reset.

No verified proof-of-concept code is available. See the upstream fix in Kernel Git Commit 6a32093 for the exact patch.

Detection Methods for CVE-2026-46040

Indicators of Compromise

Applications reporting -ENOSPC from inotify_add_watch() despite low actual watch usage
/proc/<pid>/fdinfo/<fd> showing far fewer active watches than the per-user accounted total
Sudden failure of file watchers in tools such as systemd, inotifywait, container runtimes, or build watchers

Detection Strategies

Compare per-user inotify accounting against the actual count of installed marks to identify drift
Audit kernel versions against the fix commits 6a320935, 73ddc851, 8bcc1cd2, 9e48844f, and fdaa42ca
Monitor for repeated inotify_add_watch syscalls returning ENOSPC in syscall auditing or eBPF tracing

Monitoring Recommendations

Enable auditd rules on the inotify_add_watch syscall to capture failure rates per UID and namespace
Use eBPF or bpftrace to correlate inc_inotify_watches and dec_inotify_watches call balance over time
Alert when max_user_watches saturation occurs without a matching increase in active mark count

How to Mitigate CVE-2026-46040

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits listed below
Inventory all Linux hosts and containers running kernels derived from commit 1cce1eea0aff without the fix
Restart processes affected by spurious -ENOSPC errors to release stale accounting after patching

Patch Information

The fix adds the missing dec_inotify_watches() call in the inotify_new_watch() error path. Apply the patch from one of the following upstream commits matching your kernel branch:

Workarounds

Raise /proc/sys/fs/inotify/max_user_watches to delay exhaustion until the patch is deployed
Recycle affected user sessions or namespaces to reset leaked accounting
Restrict untrusted local users from invoking high-frequency inotify_add_watch() workloads where feasible

bash

# Temporary mitigation: increase the per-user watch limit
sysctl -w fs.inotify.max_user_watches=1048576
echo 'fs.inotify.max_user_watches=1048576' > /etc/sysctl.d/40-inotify.conf

# Verify accounting drift after patching
cat /proc/sys/fs/inotify/max_user_watches
for pid in $(pgrep -a .); do ls /proc/$pid/fd 2>/dev/null | wc -l; done