CVE-2026-89595: Linux Kernel fsnotify Race Condition Flaw

CVE-2026-89595 Overview

CVE-2026-89595 is a race condition in the Linux kernel fsnotify subsystem that leaves object masks stale after concurrent mark updates. The flaw affects both fanotify and inotify interfaces when two threads update marks on the same connector simultaneously. One thread may skip mask recalculation based on a cached aggregate while another publishes a mask that omits a newly added event bit. The result is silently lost file system event notifications, including FAN_MODIFY and IN_MODIFY events, for the affected watch group.

Critical Impact
Security monitoring tools and integrity agents relying on fanotify or inotify may miss file modification events, weakening host-based detection on affected Linux kernels.

Affected Products

Linux kernel (reproduced on unmodified v6.12.95)
Subsystem: fs/notify (fanotify and inotify)
Downstream Linux distributions shipping affected stable kernel branches

Discovery Timeline

2026-09-11 - CVE-2026-89595 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89595

Vulnerability Analysis

The defect resides in the fsnotify mark update path shared by fanotify and inotify. When a mark receives a new event bit, the kernel may skip recalculating the connector's aggregate object mask if the cached aggregate already contains that bit. This optimization is unsafe when another thread concurrently updates a different mark on the same connector. The concurrent scan reads the target mark before the new bit lands, and the updater reads the old aggregate before the scan publishes its result. The updater then skips recalculation, and the scan publishes an aggregate that omits the bit.

The practical consequence is a lost-notification defect. Two fanotify groups watching the same inode can trigger the race: one thread removes FAN_MODIFY from an existing mark while another thread adds FAN_MODIFY to a second mark. After both fanotify_mark() calls return, subsequent writes fail to generate FAN_MODIFY events for the group whose mark still holds the bit. The equivalent inotify interleaving loses IN_MODIFY events.

Root Cause

The root cause is a time-of-check-to-time-of-use race in the mark-update fast path. The optimization compares snapshot values of the aggregate mask taken outside mark->lock and skips recalculation when it appears unchanged. Because FS_MODIFY handling can clear the ignore mask without holding mark->lock, and the inotify replace path temporarily sets mark->mask to zero, snapshot comparisons are unreliable across concurrent updates.

Attack Vector

Exploitation requires local processes able to open fanotify or inotify file descriptors and issue concurrent mark updates targeting the same inode. The impact is loss of file system event integrity rather than memory corruption or privilege escalation. An attacker or malicious workload with local access can race notification updates to blind auditing, integrity monitoring, or endpoint agents that consume fanotify and inotify events.

The upstream fix recalculates the object mask whenever the raw mark mask changes for normal fanotify additions, always recalculates ignore-mask updates, and always recalculates after updating an existing inotify watch. See the kernel stable commit e422777f for the reference implementation.

Detection Methods for CVE-2026-89595

Indicators of Compromise

Gaps in expected FAN_MODIFY or IN_MODIFY event streams for files under active monitoring
File integrity monitoring alerts that fire on scheduled hash comparison but not on real-time notifications
Multiple concurrent processes issuing fanotify_mark() or inotify_add_watch() calls against the same inode

Detection Strategies

Enumerate running kernels using uname -r and correlate against the affected stable branches referenced in the kernel commits
Audit host security agents that depend on fanotify or inotify and validate they receive events during synthetic write tests
Cross-check file change events against periodic hash-based integrity scans to identify missed notifications

Monitoring Recommendations

Instrument fleet-wide checks for kernel versions predating the fix commits listed on git.kernel.org
Forward host telemetry from monitoring agents into a centralized data lake to identify unexplained silence in file event streams
Track concurrent fanotify_mark() and inotify_add_watch() syscall patterns using auditd or eBPF probes

How to Mitigate CVE-2026-89595

Immediate Actions Required

Apply the stable kernel updates that include the fsnotify mask recalculation fix
Reboot affected hosts to load the patched kernel image
Validate that security tools consuming fanotify and inotify events continue to receive notifications after patching

Patch Information

The fix is distributed across multiple stable kernel branches. Reference commits include 27d172b, 2f09f08d, 343ae18e, 92289e66, 947400af, ac8d8b59, de75382d, and e422777f. Consume the fix through your Linux distribution's kernel package updates rather than cherry-picking upstream commits.

Workarounds

No supported workaround eliminates the race without the kernel patch
Reduce concurrent mark updates against the same inode from userspace where feasible
Supplement real-time notification monitoring with periodic integrity scans until patched kernels are deployed

bash

# Verify the running kernel version and pending updates
uname -r

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')

# RHEL/Fedora
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot