CVE-2026-46040

A flaw was found in the Linux kernel's inotify subsystem. When the fsnotify_add_inode_mark_locked() function fails during the creation of a new watch, the system does not properly decrement the watch count. This oversight can lead to a watch count leak, where repeated failures exhaust the maximum user watches limit. Consequently, a local attacker could trigger this condition, preventing new inotify watches from being created and resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.