CVE-2026-89595

A flaw was found in the Linux kernel's fsnotify subsystem, affecting fanotify and inotify. A race condition can occur during concurrent updates to event marks, where the object mask becomes stale. This can lead to a denial of service or information disclosure, as events such as file modifications (e.g., FAN_MODIFY, IN_MODIFY) may not be properly reported to applications monitoring file system activity.

A moderate vulnerability was found in the Linux kernel's fsnotify subsystem, which backs the fanotify and inotify file-monitoring interfaces. When multiple marks attached to the same object are updated concurrently, a race condition between the recalculation of the aggregate object mask and a concurrent update to another mark can leave the object mask stale. As a result, filesystem events such as file modifications (FAN_MODIFY / IN_MODIFY) may not be reported to applications that monitor filesystem activity even though the corresponding watch is in place, which can degrade security, auditing, and monitoring tools that rely on reliable event notification and lead to a denial of service or information disclosure through missed file modification events. Red Hat Product Security rates this flaw Moderate (CVSS 3.1 score 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): exploitation requires local access, the ability to create fanotify or inotify watches, and a carefully timed race between concurrent mark updates on the same object. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, and 9 and the RHCOS kernels shipped in OpenShift Container Platform 4 are affected. For these affected Red Hat streams the fix is currently deferred and no update is planned at this time, reflecting the limited practical exploitability of the issue (local access and precise concurrent-update timing are required, and the kernel team assessed the risk as low); the residual risk is that applications relying on fanotify or inotify event notification may miss file modification events when concurrent watch updates race, with no direct impact on kernel memory integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.