CVE-2026-52990: Linux Kernel Race Condition Vulnerability

CVE-2026-52990 Overview

CVE-2026-52990 affects the Linux kernel's fsnotify subsystem. The flaw is an inode reference leak in fsnotify_recalc_mask(), which fails to handle the return value of __fsnotify_recalc_mask(). When the connector's HAS_IREF flag transitions from set to cleared, the returned inode pointer must be released via fsnotify_drop_object(), but the caller discards it. The resulting leak prevents superblock teardown and presents as a hung umount task blocked for more than 120 seconds. The issue has been resolved upstream through commits across multiple stable branches.

Critical Impact
A race between concurrent mark add and detach operations leaks inode references, causing filesystem unmount to hang indefinitely and degrade system availability.

Affected Products

Linux kernel fsnotify subsystem (stable branches receiving the referenced backports)
Distributions shipping unpatched kernels with the affected fsnotify_recalc_mask() logic
Workloads using fanotify or inotify with evictable marks

Discovery Timeline

2026-06-24 - CVE-2026-52990 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52990

Vulnerability Analysis

The defect resides in the kernel's filesystem notification mark management code. fsnotify_recalc_mask() recomputes the aggregate mask after marks are added or removed from a connector. It calls __fsnotify_recalc_mask(), which may detect that no remaining marks require an inode reference and clear the connector's HAS_IREF flag. In that transition, __fsnotify_recalc_mask() returns the inode pointer so the caller can drop the held reference through fsnotify_drop_object(). The caller in fsnotify_recalc_mask() ignores this return value, so iput() and fsnotify_put_sb_watched_objects() are never invoked.

Root Cause

The root cause is a missed reference-counting handoff combined with a race condition [Race Condition / TOCTOU]. Thread A adds an evictable mark while Thread B concurrently detaches another mark. When Thread A reacquires conn->lock to recalculate the mask, only the evictable mark remains, so want_iref evaluates to false while has_iref is still true. The HAS_IREF flag flips, the inode pointer is returned, and the caller drops it on the floor.

Attack Vector

A local user with permission to create fanotify or inotify watches can trigger the racing add and detach sequence on watched objects. Sustained triggering leaks inode references, pinning the superblock and blocking unmount. The fix defers the HAS_IREF true-to-false transition from fsnotify_recalc_mask() to fsnotify_put_mark(), ensuring the last reference drop occurs in a context that holds the appropriate mark state. The vulnerability manifests as a denial-of-service condition rather than memory corruption or privilege escalation. See the referenced kernel commits for the patch-level changes.

Detection Methods for CVE-2026-52990

Indicators of Compromise

Kernel log entries reporting INFO: task umount:<pid> blocked for more than 120 seconds with a call trace including fsnotify_sb_delete and generic_shutdown_super.
Mount points that cannot be unmounted despite no remaining open file handles, with umount processes stuck in D state.
Growing inode reference counts on filesystems heavily using fanotify or inotify watches.

Detection Strategies

Monitor dmesg and /var/log/messages for hung task warnings naming fsnotify_sb_delete in the stack trace.
Track umount and cleanup_mnt processes that remain in uninterruptible sleep across reboots or container teardown.
Audit kernel versions against the patched commits 4aca914a, 5c80289a, 8c8afa64, and b740cc86 from kernel.org.

Monitoring Recommendations

Alert on repeated hung task warnings referencing the fsnotify call chain on hosts running container runtimes or backup agents that mount and unmount filesystems frequently.
Correlate prolonged umount latency with workloads that intensively register and remove fanotify or inotify marks.
Track kernel version drift across the fleet to confirm patched builds are deployed where the fsnotify subsystem is in active use.

How to Mitigate CVE-2026-52990

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org commits and rebuild or update affected kernels.
Schedule a reboot into the patched kernel; the leak cannot be reclaimed at runtime once references are lost.
Inventory hosts running fanotify- or inotify-heavy software such as antivirus, file integrity monitoring, and container engines to prioritize remediation.

Patch Information

The fix defers the HAS_IREF flag transition from fsnotify_recalc_mask() to fsnotify_put_mark() so the inode reference is released by the thread that removed the mark. Patched commits are available at Kernel Commit 4aca914a, Kernel Commit 5c80289a, Kernel Commit 8c8afa64, and Kernel Commit b740cc86.

Workarounds

No reliable runtime workaround exists; patching the kernel is required.
Reduce exposure by limiting unprivileged user creation of fanotify or inotify watches where feasible.
Reboot affected hosts to clear leaked references when unmount operations stall, then redeploy on patched kernels.

bash

# Verify the running kernel and confirm patch level after update
uname -r
rpm -q --changelog kernel-$(uname -r) | grep -i fsnotify_recalc_mask
# Debian/Ubuntu equivalent
dpkg -l | grep linux-image
apt changelog linux-image-$(uname -r) | grep -i fsnotify_recalc_mask