CVE-2026-46040

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A watch count leak occurs in the inotify system when the fsnotify add inode mark locked() function fails within inotify new watch(). In this scenario, the error path executes inotify remove from idr() but fails to call dec inotify watches() to reverse the previous inc inotify watches() operation. This leads to a leak in the watch count, which can eventually exhaust the max user watches limit, resulting in an -ENOSPC error even when no active watches exist.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.