CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask()

CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: fix inode reference leak in fsnotify_recalc_mask()

fsnotify_recalc_mask() fails to handle the return value of
__fsnotify_recalc_mask(), which may return an inode pointer that needs
to be released via fsnotify_drop_object() when the connector's HAS_IREF
flag transitions from set to cleared.

This manifests as a hung task with the following call trace:

  INFO: task umount:1234 blocked for more than 120 seconds.
  Call Trace:
   __schedule
   schedule
   fsnotify_sb_delete
   generic_shutdown_super
   kill_anon_super
   cleanup_mnt
   task_work_run
   do_exit
   do_group_exit

The race window that triggers the iref leak:

  Thread A (adding mark)              Thread B (removing mark)
  ──────────────────────              ────────────────────────
  fsnotify_add_mark_locked():
    fsnotify_add_mark_list():
      spin_lock(conn->lock)
      add mark_B(evictable) to list
      spin_unlock(conn->lock)
    return

    /* ---- gap: no lock held ---- */

                                      fsnotify_detach_mark(mark_A):
                                        spin_lock(mark_A->lock)
                                        clear ATTACHED flag on mark_A
                                        spin_unlock(mark_A->lock)
                                        fsnotify_put_mark(mark_A)

    fsnotify_recalc_mask():
      spin_lock(conn->lock)
      __fsnotify_recalc_mask():
        /* mark_A skipped: ATTACHED cleared */
        /* only mark_B(evictable) remains */
        want_iref = false
        has_iref = true  /* not yet cleared */
        -> HAS_IREF transitions true -> false
        -> returns inode pointer
      spin_unlock(conn->lock)
      /* BUG: return value discarded!
       * iput() and fsnotify_put_sb_watched_objects()
       * are never called */

Fix this by deferring the transition true -> false of HAS_IREF flag from
fsnotify_recalc_mask() (Thread A) to fsnotify_put_mark() (thread B).

The Linux kernel CVE team has assigned CVE-2026-52990 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit c3638b5b13740fa31762d414bbce8b7a694e582a and fixed in 6.12.91 with commit 8c8afa6444e6bdc145d2bf2f3aeeca6da3e36b42
	Issue introduced in 5.19 with commit c3638b5b13740fa31762d414bbce8b7a694e582a and fixed in 6.18.33 with commit b740cc86816bbc87902ae9db74cd21abde3c8d63
	Issue introduced in 5.19 with commit c3638b5b13740fa31762d414bbce8b7a694e582a and fixed in 7.0.10 with commit 5c80289503da3658e3df80280598c68d181eadbd
	Issue introduced in 5.19 with commit c3638b5b13740fa31762d414bbce8b7a694e582a and fixed in 7.1 with commit 4aca914ac152f5d055ddcb36704d1e539ac08977
	Issue introduced in 5.10.220 with commit ff34ebaa6f6dc1eebce6a8d6f12a1566f33d00fe
	Issue introduced in 5.15.154 with commit 4f145b67c075324b13d6ae7d5abb6e7a1dbac26d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-52990
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/notify/mark.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8c8afa6444e6bdc145d2bf2f3aeeca6da3e36b42
	https://git.kernel.org/stable/c/b740cc86816bbc87902ae9db74cd21abde3c8d63
	https://git.kernel.org/stable/c/5c80289503da3658e3df80280598c68d181eadbd
	https://git.kernel.org/stable/c/4aca914ac152f5d055ddcb36704d1e539ac08977