Medium 5.5Published May 27, 2026

CVE-2026-46040inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails

Updated under an hour ago (Oct 27, 2026, 6:20 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails When fsnotify_add_inode_mark_locked() fails in inotify_new_watch(), the error path calls inotify_remove_from_idr() but does not call dec_inotify_watches() to undo the preceding inc_inotify_watches(). This leaks a watch count, and repeated failures can exhaust the max_user_watches limit with -ENOSPC even when no watches are active. Prior to commit 1cce1eea0aff ("inotify: Convert to using per-namespace limits"), the watch count was incremented after fsnotify_add_mark_locked() succeeded, so this path was not affected. The conversion moved inc_inotify_watches() before the mark insertion without adding the corresponding rollback. Add the missing dec_inotify_watches() call in the error path.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1cce1eea0aff51201753fcaca421df825b0813b6 before 3ab58cf42c46bf2366d2f55ae5c59299d5e178b7; from 1cce1eea0aff51201753fcaca421df825b0813b6 before 10edf7e0ffdc7faa18e2244b17722c1b882b8273; from 1cce1eea0aff51201753fcaca421df825b0813b6 before 3ad9ccea1b25435f6179b57aa891960beb7ce8f9; from 1cce1eea0aff51201753fcaca421df825b0813b6 before 8bcc1cd237ab5ccfdd102869fa031c541943cf40; from 1cce1eea0aff51201753fcaca421df825b0813b6 before 73ddc8518a32baff6bc17afda4ee1ebae5b4ed12; from 1cce1eea0aff51201753fcaca421df825b0813b6 before fdaa42ca370d056428e5e171247c8fdce8dff36a; from 1cce1eea0aff51201753fcaca421df825b0813b6 before 9e48844f708eb48bae4e79cb21edc097c966306d; from 1cce1eea0aff51201753fcaca421df825b0813b6 before 6a320935fa4293e9e599ec9f85dc9eb3be7029f8	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.11 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4	NVD

References

References

https://git.kernel.org/stable/c/3ab58cf42c46bf2366d2f55ae5c59299d5e178b7	patch
https://git.kernel.org/stable/c/10edf7e0ffdc7faa18e2244b17722c1b882b8273	patch
https://git.kernel.org/stable/c/3ad9ccea1b25435f6179b57aa891960beb7ce8f9	patch
https://git.kernel.org/stable/c/8bcc1cd237ab5ccfdd102869fa031c541943cf40	patch
https://git.kernel.org/stable/c/73ddc8518a32baff6bc17afda4ee1ebae5b4ed12	patch
https://git.kernel.org/stable/c/fdaa42ca370d056428e5e171247c8fdce8dff36a	patch
https://git.kernel.org/stable/c/9e48844f708eb48bae4e79cb21edc097c966306d	patch
https://git.kernel.org/stable/c/6a320935fa4293e9e599ec9f85dc9eb3be7029f8	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.