CVE-2026-52990

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fsnotify: fix inode reference leak in fsnotify_recalc_mask()

fsnotify_recalc_mask() fails to handle the return value of

__fsnotify_recalc_mask(), which may return an inode pointer that needs

to be released via fsnotify_drop_object() when the connector's HAS_IREF

flag transitions from set to cleared.

This manifests as a hung task with the following call trace:

INFO: task umount:1234 blocked for more than 120 seconds.

Call Trace:

__schedule

schedule

fsnotify_sb_delete

generic_shutdown_super

kill_anon_super

cleanup_mnt

task_work_run

do_exit

do_group_exit

The race window that triggers the iref leak:

Thread A (adding mark) Thread B (removing mark)

────────────────────── ────────────────────────

fsnotify_add_mark_locked():

fsnotify_add_mark_list():

spin_lock(conn->lock)

add mark_B(evictable) to list

spin_unlock(conn->lock)

return

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References